Comment by ec109685

On the server, we have firecracker and gvisor to provide and extra layer of defense by not allowing userspace to directly access the kernel.

Will that be the future on client devices as well given kernels are just too complex to secure perfectly?