So the Docker security team did a lot of work in the early days precisely because people felt that it didn't provide good security isolation. As to root in a c

So the Docker security team did a lot of work in the early days precisely because people felt that it didn't provide good security isolation. As to root in a container == host compromise, what makes you say that? Absent a Linux kernel vuln. or mistake when running the container that's generally not easily possible. (that's not to say that containers should be run as root, they should not, but that it's not necessarily trivial to breakout of one)