My experience with Joyent's Triton stack has been both simple and positive. Much of the stuff in Section 10 either doesn't apply to the Triton stack (e.g. their

My experience with Joyent's Triton stack has been both simple and positive. Much of the stuff in Section 10 either doesn't apply to the Triton stack (e.g. their implementation of the Docker server doesn't leave sockets lying around), or has already been solved there (e.g. their container implementation has already been hardened over a decade, and actually works well). I'm obviously quite the fan. This document is more an indictment of the current state of the Linux container ecosystem, rather than containers themselves. Don't conflate the two.