Would be cool if there was something like qubesos, but with namespaces instead of virtual machines. I guess we’re slowly moving there with Flatpak, but they only seem to be concerned with GUI apps and see sandboxing as a convenience tool for developers, not so much as a security measure.