Sure it's breakable, but that still isn't bad advice. In practice, an application run with the evil bit set won't know how to break out of such a container, nor

Sure it's breakable, but that still isn't bad advice. In practice, an application run with the evil bit set won't know how to break out of such a container, nor how to abuse the X socket. It's only bad advice if you're relying on Docker to provide security against targeted threats. Know your enemy.