The issue is that local privilege escalation to root will always be a thing, even with seccomp limiting syscalls visible in a container. sVirt (SELinux as it re

The issue is that local privilege escalation to root will always be a thing, even with seccomp limiting syscalls visible in a container. sVirt (SELinux as it relates to VMs and containers) can make sure that even with unintended root escalation you don't touch what you weren't intending to touch. Full virtualization is preferred if this is a concern, trading off some overhead for increased isolation. But if the performance margins are thin for your containers (thus motivating the expected use of newer syscalls with increased likelihood of undiscovered/undisclosed escalations) and you're running something potentially adversarial, then take advantage of sVirt as a second layer.