I really like the idea of window isolation - I can run something in a container and not care about it misbehaving unless it’s leveraging a zero day, but I also agree that screen sharing / recording is a fundamental need. Surely there’s a middle-ground, like policy based access?
Making a GUI that supports isolating a client is a great innovation. Making a GUI that force-isolates ALL clients is obnoxious. I really think the functionality should be behind a gate like OpenBSD's pledge/unveil tools -- a process (or cgroup etc) should declare that it should be isolated, then launch whatever. Otherwise it should continue to work the way people expect computers to work! But this and other suggestions were disregarded because security.
