It's interesting to observe that every process is already restricted to only be able to do computation by default. Then along comes the OS with a plethora of holes in the sandbox to do various things. And then it's strange that we take those holes for granted and apply bandaid patches over them instead of not creating the holes to begin with. Why can't we ask the kernel to create a new extremely limited memory map and run some code until a certain software interrupt fires, then restore the previous context? Why should we have to start with a fully powered-up process and then close off its abilities, instead of starting with no capabilities except the in/out buffers and computation? In this model, there could be a deliberate backdoor in the computation and it still couldn't do anything besides DoS.

See also https://xkcd.com/2044