> You can put software built and tested on a very old kernel and it runs successfully on a modern one. This is factually untrue. CentOS 5's glibc makes system

> You can put software built and tested on a very old kernel and it runs successfully on a modern one. This is factually untrue. CentOS 5's glibc makes system calls using the vsyscall page, which is off by default in e.g. Debian stable kernels because it's a huge security risk (it's a page at a fixed address that makes syscalls, it's an obvious ROP target and makes ASLR completely irrelevant, and it also contains fixed data so it's a useful target for other attacker-controlled pointers too). So CentOS 5 containers do not run on up-to-date Debian systems unless you reboot and change a kernel option. I think vsyscalls are on by default in Linus's tree but no distributor is gonna turn them on and take the security risk. The knob was put there so it could be turned off.