You're missing my point. It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux probl

You're missing my point. It's effectively impossible to ever provide security at the program-system interface, due to the surface area. (I.e. the SELinux problem) The very concept of having a container (that internally simulates a system) creates fundamentally different opportunities that allow both (programs that work) and (security). Whinging about whether or not current containers do a good or bad job of it is a less interesting, short term quibble.