Namespaces in 9front (actual ones, not second hand ones like under Linux) makes isolating software trivial.