> Can you run docker containers in userspace? Yes, and it increases the attack surface even more in some scenarios. Now, an unprivileged user can create new na

> Can you run docker containers in userspace? Yes, and it increases the attack surface even more in some scenarios. Now, an unprivileged user can create new namespaces and do all sorts of things which were previously limited to root. With "clear containers" (very minimal KVM VMs), you get the overhead down to <20MB: https://lwn.net/Articles/644675/ https://lwn.net/Articles/644675/ Also, RAM is cheap.