If you have all the modern (on by default) side-channel mitigations on, it's a pretty safe isolation barrier. Not being able to f with your drives & see your da

If you have all the modern (on by default) side-channel mitigations on, it's a pretty safe isolation barrier. Not being able to f with your drives & see your data is a pretty enormous win. Set some cpu & mem limits. Im not sure what the default behaviors are but there s likely still things like a docker0 bridge, & many of your services are probably exposed there. You can change your services, you can change yoyr container networking, or you can live with letting containers see your local services. I think i general how secure you want your network to be is one of the most interesting/harder things to be certain about. I have a hard time thinking what the remaining risks are. Certainly you could give the container too many permissions or give it access or network you shouldnt. In general, I feel like we've gotten quite good at preventing break-out attacks.