What I think you're referring to is, every process has its own view of the file system. So you can control what a process has access to simply by controlling what the file tree visible to it looks like. The upshot of this is that each process talking to rio can open a file called '/dev/draw' if it wants to draw to its window, but each process sees its own '/dev/draw' and can thereby only draw to its own window! This can't be done very well in a POSIX OS, for which the file system namespace is global; extensions like Linux containers are a (shitty) workaround for this flaw.