Wow, that sounds really exciting. How would this work for something like a service that runs for a long time, and periodically needs to make a web request (and therefore periodically opens a TCP socket)?

Are you counting the ability itself to open sockets as a "file descriptor"? Is it straightforward to implement a "namespace" (not sure if I'm using that correctly) that limits network access to certain IP addresses? Certain domains?