> but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when u

> but how many Linux servers are out there running outdated software on a system that hasn't been patched in years because it's working and stops working when updated? By the millions. If you work in security and do assessment for large companies you can find plenty. Then if you add non-Linux system it's order of magnitudes. > I can treat the security of the system separately from the application > all my services are slightly more isolated from the underlying OS, which limits exposure if an inherent security flaw Not at all. Docker has a huge attack surface compared to all the sandboxing systems that run rootless and without any daemon. Also, sandboxes/containers provide limited security and isolation anyways compared to VM. Furthermore, sandboxes are not alternatives to VMs. E.g. lot of OS services/daemons are sandboxed by default and at the same time the whole OS is deployed in a dedicated VM. Finally, tons of critical infrastructure runs on bare metal, with one service/application per device. Running a container there is a net negative for security.