So a separate user for every application I run?

Just locally, that seems like a huge pain in the ass... At least you can suggest containers which has an easier interface around it generally speaking.