Fundamentally they share a kernel with the host. This has its own implications. Beyond that it is very difficult to get things right, and there's definitely so

Fundamentally they share a kernel with the host. This has its own implications. Beyond that it is very difficult to get things right, and there's definitely some information leakage (e.g. see the output of `mount` in a docker container... not a docker specific problem). The main issue is, having a VM layer is always going to be "more secure" (because it's another security boundary) than not having a VM layer. Of course VM's have their own issues. So if you have a need to run multi-tenant/untrusted workloads it's kind of a CYA situation where if you don't use this extra security boundary and there is a problem sometime down the line then you'll have to answer questions like "why didn't you do ..." The reality is you can do a lot to lock things down with seccomp+selinux/apparmor.