rfork(2)1 is a variant of fork(2) that allows fine grained control of what resources are shared between the parent and the child.

It could allow processes/threads that could be spawned with a very restricted set of capabilities for one off tasks like safely parsing files from untrusted sources.

This might be a potential solution to #1057.