Doesn't sound very practical, especially for grahical programs.

Security is compromise. You can share your whole home directory, if you trust the software, but it will make any kind of protection useless, or you can write a helper tool, which will grant access to a single selected file using a hard link, to make alias for file content, or synchronize files between directories, or mount a shared directory to both container and your home directory, or use SELinux to grant access to a selected directory only. Chose your own compromise.

But it doesn't have to be such a shitty compromise. Most desktop applications could be made such that you have all the security and the convenience.

Separate user for untrusted apps is the proven way to do that in UNIX. :-/

That can happen under the hood, but the user should not have to deal with that

This is how Android does security AFAIK — every app is run as a different user.

If they connect to the same X display, it doesn't matter what user they run as.

So, give separate X server (Xephyr, Xnest, Xvnc) per app for increased security. They will be isolated from clipboard, window titles, and broadcasted key events.

Yes, but in my experience at least, Firefox is not usable running under Xephyr. It's simply too slow for regular web browsing, forget about trying to watch any kind of video.

In theory, the X11 Security Extension would seem to provide a middle ground. On the plus side, I don't notice any performance impact when running Firefox as an untrusted client. However, most programs aren't coded correctly to coexist with it. For example, Firefox crashes regularly when running as such (via SIGSEGV no less, which is its own yikes). Not only that but many programs that are themselves trusted (i.e. normal/default X11 clients) will misbehave if they are simply near an untrusted client: LibreOffice Calc, for example, will lock up hard if the untrusted clipboard is in use.

That is nowhere near practical.

All system daemons are running this way. It's the standard way to isolate networking services on UNIX.

And no user-facing UI apps do this or are built for it, and no desktop environment has any kind of support for doing it.

It just doesn't work in practice.

Desktop environments have nothing to do with that: it's the job of distribution. `gksu` is popular to run graphical apps under root or another user, for example, until it was removed from distributions because distributions don't want to allow users to run untrusted apps as root.