Containers are fantastic at isolating one software application from another. All their dependencies - runtime, library, packages - live in separate chrooted fil

Containers are fantastic at isolating one software application from another. All their dependencies - runtime, library, packages - live in separate chrooted filesystems. User-to-user isolation is hard, and extremely hard if any of the users could be malicious. Docker is broadly neutral here - adds a few tools, might add a few vulnerabilities.