It's not clear to me that VMs actually do offer better isolation than well-designed containers (i.e. not docker). It's basically a question of: do you trust th

It's not clear to me that VMs actually do offer better isolation than well-designed containers (i.e. not docker). It's basically a question of: do you trust the safety of kernel-mode drivers (for e.g. PV network devices or emulated hardware) for VMs, or do you trust the safety of userland APIs + the limited set of kernel APIs available to containers. On my FreeBSD server, I kind of trust jails with strict device rules (i.e. there are only like 5 things in /dev/) over a VM with virtualized graphics, networking, etc.