A well-configured recent version of Docker on a well-configured recent linux host has no known exploits. But it's a matter of risk management. The general cons

A well-configured recent version of Docker on a well-configured recent linux host has no known exploits. But it's a matter of risk management. The general consensus in the security community is that Linux containers (the set of kernel features used by Docker to isolate processes) are a solid security layer in some configurations, and with a little more operational mileage, will be solid in all configurations (most importantly running untrusted code as root, thanks to user namespaces). The limit for linux container security will soon be linux security itself: the probability of finding bugs in the linux codebase will always be greater than, say, in Xen which is considerably smaller and simpler.