How can the security be comparable? I would have thought that the kernel shared between containerized processes presents a much bigger attack surface than a vi

How can the security be comparable? I would have thought that the kernel shared between containerized processes presents a much bigger attack surface than a virtual machine monitor does.