Containers became popular because it doesn't make much sense to be running full blown virtual machines just to run simple single process services. You can lock

Containers became popular because it doesn't make much sense to be running full blown virtual machines just to run simple single process services. You can lock down the allowed kernel syscalls with seccomp and go further with confining the processes with apparmor. Docker has good enough defaults for these 2 security approaches. Full fat VMs are not immune to malware infection (the impact still applies to the permitted attack surface). Might not be able to easily escape to host but the risk is still there.