In my opinion, if you want to grab some code off the internet and run
it in a sandbox, you should spawn a slave image and run it inside that
image.  The VM should ensure that any important requests have to go
through the master image.

In the same way, Croquet really ought to run each island as a separate
image.  The UI ought to be able to look into each island to display
it.  This would make it easy to prvent cross-island references.

Similarly, the way to write parallel programs is to spawn an image for
each core. In general, a single image should be a single process.  It
should be easy to develop an application that consists of a set of
images.

-Ralph Johnson