[wpm]

I'm surprised that given Apples love of sandboxing, especially on iOS, that XNU doesn't have something similar to namespaces or jails.

[bjoli]

IIRC they went for policy based sandboxing with Seatnelt and SIRP. That is pretty darn nice for gui apps, but not very good for things like containers.