Illustrating app-domain isolation