It's improved, though still a root exploit in the kernel will almost certainly make possible root access to the host. For a lot of situations, this is an accep

It's improved, though still a root exploit in the kernel will almost certainly make possible root access to the host. For a lot of situations, this is an acceptable risk. The real win in the present for containers is simplifying deployment and improving segmentation of services that already might run on the same machine.