> I can't find too much information on this, does docker mount /proc from the host by default in each of the containers? Sorry, I should have clarified: It's /

> I can't find too much information on this, does docker mount /proc from the host by default in each of the containers? Sorry, I should have clarified: It's /proc for the specific PID namespace. So in theory it doesn't leak anything bad. The problem is that it's a huge attack surface; there have been bugs in /proc before. > I think that sandboxing the language is pretty tough in the general case, since every language takes a lot of effort. In non-managed, compiled languages, it will be even tougher. WebAssembly sandboxes non-managed compiled languages pretty well. :) > What is your opinion on tools like SELinux as a secondary layers? IMO it doesn't help very much, because many of the kinds of kernel bugs that allow you to escape a container tend to allow you to escape SELinux as well.