we could probably do that for process execution sandboxing/etc in the new engine. but... big change. would probably have two workdirs for a while