[palata]

> For kernel safety applications must be denied direct access to the host kernel, this is usually achieved with virtual machines.

And that is what QubesOS does, if I understand correctly?

[ThePowerOfFuet]

You do understand correctly.