I mean, of course, we have these apps that splay themselves all over global system resources in complex ways, and so we need to track down how they've done that, record it, and then replay it later to restore them. It's necessary.
But imagine a well-behaved classical X11 app, running in something like a VM or Docker container. You execute its launcher, the VM spins up in the background, the app launches in the VM, and the app's X11 client connects to the X11 server you're staring at and displays things.
If we truly want to sandbox apps, wouldn't it make more sense to move more toward a model like that—one where you have a discrete "application backend process" running in a sandbox, and you can just chuck around the sandbox itself willy-nilly (freezing it, thawing it, copying it, etc.) because it has well-defined connection-points to the host?
