One thing to watch out for when reading anything about container/Docker security is the date of the advice. that paper is from March last year, and there have

One thing to watch out for when reading anything about container/Docker security is the date of the advice. that paper is from March last year, and there have been a lot of improvements to Docker security since then. Docker makes use of namespaces/capabilities/cgroups and syscall filtering by default and you can add apparmour or SELinux policies on top if you like. So the attack surface of a running docker container very much depends on how you've configured it. It's likely still larger than a VM Hypervisor, but I know that there are large organisations using containers for multi-tenancy, so I guess some people are ok with that kind of configuration...