Yes, for a very long time the Linux devs were emphatic that cgroups should be not be treated as an actual isolation/security barrier. This was flagrantly ignore

Yes, for a very long time the Linux devs were emphatic that cgroups should be not be treated as an actual isolation/security barrier. This was flagrantly ignored and like most things in the Linux ecosystem, the functionality was eventually kinda-sorta backfilled based on the community's refusal to accept anything else. Meanwhile, FreeBSD and Solaris had quietly provided coherent tools to accomplish the same ends securely for many years. The story of the BSDs and illumos is really a tragedy about the complete and total disconnect between technical quality+value and technology adoption. People utilize technology products as fashion statements first and foremost, and the Linux fashion was easily the most desirable -- indeed, aside from PC v. Mac, it's the only one generally known by average technophiles. As a technical entrepreneur, I've discovered the sad reality that it's really only the most superficial 10% of any functionality that drives virtually all adoption. Everything else is marketing, even in supposedly heavily-technical endeavors like running an open-source kernel. The more you invest in engineering beyond that initial superficial component, the less you have to invest in brand promotion. One can choose to gratify their own sense of righteousness and ignore this, and that is certainly a valid option to take, but then they shouldn't be surprised to see their lunch eaten by someone who took the other side of the bargain.