Nothing is stopping you from using namespaces, and containers are just namespaces with cgroups etc But containers aren't jails, pid and uid remapping is just r

Nothing is stopping you from using namespaces, and containers are just namespaces with cgroups etc But containers aren't jails, pid and uid remapping is just remapping. A huge problem container has to drop capabilities on the honor system. In the default docker mode, running as root, anyone who can launch a container can read from any block device if they don't drop the mknod capability as an example. Actually a privileged container can update the bios or even load arbitrary kernel modules in the host context or change kernel parameters as it is a shared kernel. I tried to get the docker folks to add a conf option disallow privileged container but they refused. You can run in user mode now but most people want persistence and other features that don't allow for that. The important point is if you assume containers are a security feature you are going to have a bad time. Jails were bad enough and containers are just one step up from chroots as far as security go. namespace isolation is the main benefit of containers. Selinux and apparmor are far more appropriate than containers for the security concerns. While I don't personally like selinux, apparmor profiles are pretty easy to write.