Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a contai

Docker uses SELinux, seccomp and apparmour as well as stock Linux capabilities (in conjunction with namespaces) to reduce the attack surface exposed to a container. There's nothing inherently insecure about containers (look at FreeBSD and Solaris). The issues you see with Linux "containers" are usually caused by leaky abstractions (namespaces that don't namespace the entire kernel) and insufficiently clever setup scripts. But it is getting better.