> Running in a user-agent which is explicitly adversarial to the app's interests and capable of e.g. filtering out and rejecting its HTTPS requests and changing its displayed content based on user preferences, such as preventing the loading or display of advertisements/tracking/etc.

I would love to have that in my OS. But, let me know what browser you think that is. It's not Firefox, nor Chrome, and certainly not Edge.

> Please by all means suggest an established sandboxing technology that applications use that already does that.

Linux cgroups is an established sandboxing technology. It has the potential to do what you want but currently needs more work to make it simple.

Applications don't use it to the extent that they should.

> why should I bother when I already have one that does what I want and that applications actually use?

Because browsers don't do what you want. Browsers have been subverted to no longer be user agents. Browsers don't reject HTTPS requests that aren't in the best interests of users. You have to install extensions to get that. If you have to customize your "user agent" then I suggest that customization belongs at the OS level. Otherwise, for example, in the case of Windows or macOS, you're just running someone else's game and the browser is merely a veneer.

> When I run other people's applications, I want them to either be Open Source or I want them to stay confined to a browser tab.

I want more restriction than a browser tab. I want more restriction than browsers are going. I want this in the OS and the reason it doesn't yet exist is because there are so many web developers who build terrible web apps instead of learning computer science to build a (terrible) native application and ask for the same restrictions in the OS instead of a browser.

Access to store and retrieve user credentials? No. I want to run multiple instances of the same app without every app seeing all of the credentials. I want a separate password manager that lets me choose when or where to provide credentials.

Access to store things on my computer [0]? No thanks at all. If you're running in a browser, you should be lightweight. You should eat the storage expenses for your app and you should minimize your app's size to minimize your network transfer costs. I have very limited storage space, limited write endurance, and web apps waste both.

Run stuff in the background [1]? No. Run your compute on your own hardware. Power is expensive and that web app running whatever it's running is making my whole system slow down. Ten different tabs, for six different apps, all thinking they can run whatever the hell they want, and leaves very little available for me to actually get work done.

Access to my GPU [2]? Dude, no. I have a slow GPU and that crappy web app is slowing everything down while eating both main memory and also GPU memory. And who knows what kind of security isolation GPUs have these days (protip: none)!

Access to my USB devices [3]? No friggen thanks. That slow hard disk? It's USB. And that USB bus? Yeah it's slow too. And what a security nightmare: that's where my USB-to-ethernet adapter is, on the same slow bus!

Microphone? Camera? System notifications? No, no, no [4].

I want what you want, but I want it at the OS level. Without OS-level control, that web app isolation makes everything worse.

[0]: https://en.wikipedia.org/wiki/Web_storage

[1]: https://en.wikipedia.org/wiki/Web_worker

[2]: https://en.wikipedia.org/wiki/WebGPU

[3]: https://en.wikipedia.org/wiki/WebUSB

[4]: I got lazy and stopped looking for more web APIs for you