Comment by nicecars

Is full application/process separation due to virtualization or sandboxing? Or by a validated kernel hypervisor? Or something like Unikernel?