The ISFS namespace is global. Here's how:

XXX create a page each for volumes, journals, checkpoints, locking

XXX checkpoint directory can be root directory -- ISconf uses this, along with StreamSnapshot?.

    on disk:
        /var/isfs/cache/foo.com/
            block/{uuid}
            volume/{fsname}/
                journal
                lock
        /var/isfs/private/foo.com/
            .gnupg/
            authorized_hosts
            authorized_users
            volume/{fsname}/
                journal.new
                history

    journal can be encrypted, but isconf can't use an encrypted journal
        application provides encryption key on mount()
    journal can contain encryption keys for blocks
    network-level ACLs handled by link layer
    volume-level write locks
    no read locks