Basically the VM is sandwiched between the host and parent OS. With a full VM you have a separate kernel. With containers, like Docker, you share a kernel. The

Basically the VM is sandwiched between the host and parent OS. With a full VM you have a separate kernel. With containers, like Docker, you share a kernel. The VM is then considered more secure because it adds that extra layer between them... but is it? It's just more code - more code, more problems. The more effective solution is to simply harden the kernel of the host system, and then use a lighter solution like docker. Grsecurity + Docker seems like a solid fit to me, and you can mash another layer like Apparmor on top. It is very rare that I see a kernel vulnerability that would not be entirely mitigated by Grsecurity, or otherwise made far more costly. The point is to stop adding layers on top and instead to focus on security that lower, trusted base.