Though I agree in principal with what is trying to be said it's unfortunate that it's wrong in several places. For instance, Docker doesn't enforce you to run

Though I agree in principal with what is trying to be said it's unfortunate that it's wrong in several places. For instance, Docker doesn't enforce you to run a single process per container. It simply requires you to provide it with one root process. This is true for all *nix systems, if you wanted to you could give it /sbin/init (or busybox, or systemd, or a custom supervisor) and launch SSH, NTP and friends under that. All true on the networking front, things really do suck there out of the box. I would recommend looking at flannel with the native VXLan backend to reduce said suckage. The storage stuff is made somewhat ok by the ability to pass volumes or entire storage devices in, which is what you should be doing for anything performance sensitive.