I wonder if there is any reason each tab isn't spawned in its own container. It seems the natural thing to do once you have implemented this, since it maximizes privacy. Unless the resource usage is the limiting factor, I don't see a downside. Am I missing something?