But a bug in the OS will bite you whether you are using containers, VMs or physical servers, so it's not very relevant to the discussion. When comparing the se

But a bug in the OS will bite you whether you are using containers, VMs or physical servers, so it's not very relevant to the discussion. When comparing the security of containers to VMs, vulnerabilities in the OS should be out of scope. A more realistic attack scenario would be a virtual host or container server with two VMs/containers: a trusted on and an untrusted one. Assume neither has networking, but the untrusted one is running compromised software. The question is how easy is it to escalate privileges from the untrusted container/VM to the trusted one? I'd say that Xen's small code size and resulting easier auditing is a benefit here.