Because each container image has only that app, and only what it requires (libraries, etc.), and each container instance runs only that app's process, and only

Because each container image has only that app, and only what it requires (libraries, etc.), and each container instance runs only that app's process, and only with the very specific hardware/filesytem access that it requires.