For many, many services, requiring an entire separate exploit against the kernel is a huge win. So many services can just be dropped into a container with rough

For many, many services, requiring an entire separate exploit against the kernel is a huge win. So many services can just be dropped into a container with roughly 0 effort. If you want a higher level of security it's going to take significantly more effort.