The Linux kernel is simply not designed to run trusted code and untrusted code at the same time. One service has a bug or a security flaw and everything goes down with it.
The sandboxing is a convoluted mess few even know where to start learning to use. Lets say you successfully configure process namespacing, network namespacing, filesystem namespacing, cgroups, and apparmor or selinux all correctly to restrict every last syscall. You will still get burned by a crash, resource exhaustion, or security breach due to the next of a long series of implementation bugs in each of these arcane features.
Humans cannot create a large codebase of coherent and provably correct C code with memory safety and they really should stop trying.
Hypervisors are the only sandbox that works reasonably well and burning some extra ram is cheaper than most security breaches.
The sandboxing is a convoluted mess few even know where to start learning to use. Lets say you successfully configure process namespacing, network namespacing, filesystem namespacing, cgroups, and apparmor or selinux all correctly to restrict every last syscall. You will still get burned by a crash, resource exhaustion, or security breach due to the next of a long series of implementation bugs in each of these arcane features.
Humans cannot create a large codebase of coherent and provably correct C code with memory safety and they really should stop trying.
Hypervisors are the only sandbox that works reasonably well and burning some extra ram is cheaper than most security breaches.