buildstep.Isolation and Isolated: its own namespaces with only a loopback, an environment of exactly what the step is given, the system and toolchain read-only, the workspace writable, and no home, key, bus login, runtime directory or name service.
