I once found at jboss.org a description on how to setup applications to run in a private classloader, so that all code and jar files placed in an EAR are 100% private to the EAR.
This feature worked great in jBoss 3.2.3. Applications were isolated from each other and from jBoss, so that you could build applications without any concern as to what version of log4j, apache commons or any other libraries jBoss used. (Portable code in Java? Wow! *sarcastic laugh*)
It was simple, done by adding <loader-repository-config> java2ParentDelegation=false </loader-repository-config> to META-INF/jboss-app.xml.
But (at least) in 3.2.6 and 4.0.1 this feature does not work any more. For full details please see the reported bug JBAS 1551.
My guess is that new configuration elements are needed, but I have not found any such info after weeks of searching and several forum postings. Of course, this could be an actual code bug in the server.
If you know what is new/needed, please reply or post a URL with the current docs.