In kernel insecurity you mean. Lxd escape is trivial, might not use a container anyway if security is the goal. Xen with driver domains and (only just started)

In kernel insecurity you mean. Lxd escape is trivial, might not use a container anyway if security is the goal. Xen with driver domains and (only just started) similar support in KVM is about the kit reasonable thing from security point of view. Maybe VMware but that cannot be studied.