> Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? If I keep my boxes up to da

> Those solutions still allow the host and all the other containers to be compromised through a kernel exploit, though, can't they? If I keep my boxes up to date I only need to worry about zero day kernel exploits. So if someone comes along and uses a zero day kernel exploit to escape my FreeBSD jail then they were going to get on the box anyway, because any attacker using a zero day is highly skilled and highly targeted. > The most secure isolation is provided with physical separation. Second best is VMs. Containers are a distant third. While I agree that physical isolation is the safest, I don't think it's so cut and dry between containers and VMs. Virtual machines have significantly more attack surface than either Jails or Zones, think of all the emulated devices.