Capsicum was an amazing project. I am not familiar with where it is at the moment and not freeBSD user (though looks more and more tempting) and I thought a lot of it went largely unused, if you have any links on how they built stuff around it I would be very interested.

> OpenBSD pledge+unveil This was one of those things that now seem obvious, and is elegant albeit in that unixy way. From what I can tell one could built something on linux with seccomp or openbsds pledge to implement a runtime that could allow for implementing such structures all in usersapce not just process isolation but creating IPC that allows for determinism and other things. (I think it's more seccomp with filtering syscalls though where this becomes feasible I don't know if anyone has done this before)