The chart is very out of date. rkt has support for userns, the capability set is identical to that of Docker, and so is the default seccomp configuration. The S

The chart is very out of date. rkt has support for userns, the capability set is identical to that of Docker, and so is the default seccomp configuration. The SELinux policy used by rkt has always been identical to the one used by Docker (I have no idea why the chart claims there was a difference), and it's used by default if SELinux is enabled on the system. Rkt has no apparmor policy support, the set of files under /proc restricted by rkt is still slightly smaller than that restricted by Docker, and the cgroup difference doesn't actually appear to be discussed in the NCC paper so it's hard to comment on the difference there. I don't want to criticise Docker here from a security perspective - several security features in rkt are based on the implementation in Docker, and running your apps isolated under Docker is definitely more secure than running them all on the same unconfined host. (Disclaimer: I work at CoreOS, though not primarily on rkt)