Maybe I'm just naive, but I don't really understood the security narrative of containers or kernel namespacing. If you have a zero-day for a VM, you still have

Maybe I'm just naive, but I don't really understood the security narrative of containers or kernel namespacing. If you have a zero-day for a VM, you still have to deal with the supervisor OS even if you can get out of the VM but it's not clear to me that that's the case with kernel-side isolation. Am I missing something? I suppose you could implement a sub-kernel within the kernel, but then what's the point of using a container vs a VM? Yes containers are much lighter weight than a VM, but for most people's workloads (read: anyone not running giant Map Reduce jobs) does it really matter?