Comment by gtjay

As I've discused before, seccomp can block ptrace and thus this VDSO-based attack (and currently does by default in some distros). Shameless self-link to that post:

https://medium.com/@gtrevorjay/consider-containers-a-case-st...

Containers are not a security panacea. However, it is equally erroneous to say they don't add layers to defense-in-depth.