This is why it's not an obvious win for containers over VMs. Existing low-assurance operating systems aren't good enough to trust the basic set of usermode sysc

This is why it's not an obvious win for containers over VMs. Existing low-assurance operating systems aren't good enough to trust the basic set of usermode syscalls to be totally privesc-free. But I guarantee you that the set of syscalls permitted to a jailed process on e.g. freebsd has been pretty thoroughly worked over. If a PE exists, it's going to be expensive. It's possibly a smaller effective attack surface than virtio networking, display, disk, etc.