True. But it's also an illustration of how relying on an OS' native sandboxing capabilities is nicely composable with other isolation techniques.