[btown]

Full process/container isolation for many instances of untrusted code, perhaps? A serverless PaaS could use this to cut down significantly on the frequency of cold starts, all else being equal.