From your link: >One primary risk with running Docker containers is that the default set of capabilities and mounts given to a container may provide incomplete

From your link: >One primary risk with running Docker containers is that the default set of capabilities and mounts given to a container may provide incomplete isolation, either independently, or when used in combination with kernel vulnerabilities.