1. One or more non-transitory computer-readable storage mediums storing one or more sequences of instructions for partitioning network resources among virtual machines, which when executed by one or more processors, cause: upon a device receiving, from a first virtual machine executing on the device, a first request for network resources located over said one or more networks from said storage mediums, consulting policy data to determine how to service the first request; the device processing the first request by providing the first virtual machine with access to a first portion of the network resources, wherein the first virtual machine cannot access any of the network resources other than the first portion; upon the device receiving, from a second virtual machine executing on the device, a second request for network resources located over said one or more networks from said storage mediums, consulting the policy data to determine how to service the second request; and the device processing the second request by providing the second virtual machine with access to a second portion of the network resources, wherein the second virtual machine cannot access any of the network resources other than the second portion, and wherein the first portion is not coextensive with the second portion, and wherein the policy data is implemented by a module that decides which activities can be executed within said first virtual machine and said second virtual machine, including one or more of access control, determination of available resources, resource servicing, and creation or elimination of said first virtual machine or said second virtual machine.