One such feature is the use of seccomp, which removes all but 4 system calls:

read, write, sigreturn and exit

This is used by many browsers and apps to reduce the impact of security flaws and untrusted code (such as js from a website).