I mean, containers can provide isolation. Linux has had a hard time getting that to be reliable because it started with the wrong model: building containers su

I mean, containers can provide isolation. Linux has had a hard time getting that to be reliable because it started with the wrong model: building containers subtractively rather than additively. Though even starting with the right model, until you have isolation for every last bit of shared context that the OS provides (harder to identify than it may seem at first blush!) you won't have a complete solution. And yes, software-based containers will tend to have some leakage. Even sharing hardware with hardware isolation features might not be enough (hello row hammer). It would be good to have containers aim to provide the maximum possible isolation.