Please, your trolling is not really welcome.

> It would be quite straightforward to map a capability-like UNIX socket into each service’s filesystem and give it a private view of the world. But instead…

Can you link to your PR where you solved the problem?