1. A system comprising a processor for restricting access to resources, the system comprising: an operating system module, executed by the processor, adapted to serve a system processing environment, the system processing environment associated with a physical file system comprising a plurality of nodes representing files or directories; and a restricted environment comprising: a parent silo within the system processing environment, the parent silo associated with a first silo-specific space created by combining a portion of an existing physical file system stored in a non-volatile storage medium with a silo-specific virtual hierarchy stored in a volatile storage medium, the first silo-specific space configured for preventing a first process executing in the parent silo from accessing elements of the physical file system outside the parent silo; and a child silo created by the first process executing in the parent silo, the child silo associated with a second silo-specific space configured for preventing a second process executing in the child silo from escaping the child silo, wherein the operating system module is configured to monitor file system access requests made by the second process executing in the child silo and dynamically create in response thereto on an as-needed basis, a child silo-specific directory comprising a virtual root, a first branch that is a virtual branch below the virtual root, and a second branch that is obtained from the physical file system and grafted below the virtual root.