Containers (which are more than just cgroups) are supposed to be secure. In practice, the attack surface is much bigger for containers than VMs, so there are f

Containers (which are more than just cgroups) are supposed to be secure. In practice, the attack surface is much bigger for containers than VMs, so there are far more "break out of container" vulnerabilities out there than "break out of VM" vulnerabilities. Most containers are run in a VM, usually one being run for you by Amazon or Google.