Re Docker, chroot, etc: the boundary around a VM is both easier to understand and more hermetic than around a container. The learner already has a pretty good

Re Docker, chroot, etc: the boundary around a VM is both easier to understand and more hermetic than around a container. The learner already has a pretty good idea of where a computer stops. They can pretty much transfer that knowledge to a VM and not have any problems for a long time. Whereas with Docker, what's a filesystem? What's a process namespace? And, well, I wouldn't do anything in a container that I couldn't afford to leak out into my host system. In a chroot especially, the files are just sitting there, waiting for a newbie to touch them from the wrong context.