Those userland contexts are mostly independent. They can not see each others processes, they can not see each other, they can have completely different ip adresses (or you can share if you only have one ip address, if you share, only one userland context can use a given port number).
This separation allows you to limit the userland context in various ways. Like memory, cpu time, network IO, disk access. |
Those userland contexts are mostly independent. They can not see each others processes, they can not see each other and will not interfere with eachother in any way.
Resources, Flags and Capabilities are per Context. This allows you to limit the userland context in various ways. Like memory, cpu time, network IO, disk access. |