> Every container escape is kernel bug Well, not so fast. Ubuntu apport (its coredump collector and crash reporter) had a series of bugs over multiple years wh

> Every container escape is kernel bug Well, not so fast. Ubuntu apport (its coredump collector and crash reporter) had a series of bugs over multiple years which could be used to escape from containers. This is all because coredump filter is still a global thing and not a per namespace one. I agree with you it's actually more secure than people thought it is. A rule of thumb: just treat it as same as "running multiple applications with different user". Yeah, not a real sandbox. But nowadays also not many low hanging fruits, either.