* Give each app its own isolated container .* Security hole in an app will not affect others .* Dynamic resource management controls runaway processes.