The only advantage I see to containers over VM is RAM sharing. Beyond that, hardware VM's are better performing and much more secure. gVisor is just another fl

The only advantage I see to containers over VM is RAM sharing. Beyond that, hardware VM's are better performing and much more secure. gVisor is just another flavor of containers that replaces kernel interfaces with a Go shim layer to reduce the attack surface in return for worse performance. If somebody could hack ram sharing/overcommit into traditional VM's all this container nonsense could be dispensed with. Containers are a virtualization layer just like the old days when we used the JVM to run "safe" applets on client machines. Like the JVM, the attack surface will always be huge and security issues nearly endless.