> They simplify the OS's existing abstractions I am pretty sure they're supposed to use a somewhat "Cooperative Namespacing" schema, that makes both the appli

> They simplify the OS's existing abstractions I am pretty sure they're supposed to use a somewhat "Cooperative Namespacing" schema, that makes both the application and the OS/container abstraction layer more complex, while attempting to deliver lower overhead for said namespacing. Sorta like Cooperative Multitasking, compared to Preemptive Multitasking. And even that doesn't work for some situations; as an example, old versions of Java (7 and older) will use the incorrectly namespaced Linux file system APIs to incorrectly read whole-system limitations instead of current container limitations to setup memory and CPU parameters. > remove a lot of pointless attack surface. Not really, containers are for lower overhead cooperative namespacing, not security. You want bare minimum lightweight VMs for security.