Because the problem isn’t that there is one bug in a specific implementation, it’s that the whole model is fundamentally prone to this type of problem. cgroups

Because the problem isn’t that there is one bug in a specific implementation, it’s that the whole model is fundamentally prone to this type of problem. cgroups, Jails, and Zones all suffer from having to cover an immense surface area. Contrast with VMs, which only require managing a few, significantly simpler interfaces. There are definitely differences in quality, but they all use a similar approach.