it is a sandbox against unintentional attacks and mistakes (sudo rm -rf /)

but will not stop serious malware