Apps using Holo (Holochain apps) run on a virtual machine inside the Holochain engine. This prevents access to system resources. Holochain apps can only make calls supported by the Holochain engine, which are limited to reading and writing to attached Holochain data stores (source chain & DHT). Applications using Holo don’t have direct access to the underlying file system or other system resources, so your system will be safe while running apps on Holo.

More info about Holochain apps