I'm only luke-warm on the concept. I would much rather see improvements in the virtual kernel technology w/ regards to ease of use, features, and performance. I think we risk serious fragmentation of the security space by implementing all these weird little security features that we are more likely to trip over then anything else. One thing that would be very cool would be a system call that locks out all new file descriptor-creating system calls (like open, socket, etc), and also locks out namespace functions like remove(), chmod(), and functions like fork() and exec*(). The idea being that you would be able to start a vkernel and the vkernel would make this system call after setting up its virtual network and disk, but before starting the init process.. -Matt