There is a glaring omission from the possible attacks: the kernel itself provides a huge surface area and local root exploits are not uncommon. Speaking as an

There is a glaring omission from the possible attacks: the kernel itself provides a huge surface area and local root exploits are not uncommon. Speaking as an infrastructure/devops/hosting consultant - I've done a couple of Docker deployments lately and clients often ask whether it's suitable for hosting multiple semi-trusted codebases on the same metal for better resource utilization. I tell them "no": once a competent attacker has shell they will not find it hard to escape the sandbox and take over the parent machine, and with it all other hosts. Docker is a great tool for rapid deployment, dependency management and dense hosting of microservices but security was never the primary goal. Hypervisor based virtualization solutions (e.g. Xen, VMWare) expose a much smaller attack surface to the child environment. I would therefore say that while more resource intensive they are a far safer way to spin up honeypots.