https://github.com/google/capsicum-linux https://github.com/google/capsicum-linux would basically render this entire class of bug impossible if used correctly.

https://github.com/google/capsicum-linux https://github.com/google/capsicum-linux would basically render this entire class of bug impossible if used correctly. It would probably require a redesign of how docker interacts with the host filesystem though, and obviously relies on something that isn't yet in the mainline Linux.