1. Docker is not synonymous with Linux containers. LXC for example has always had much better security than Docker despite using the same infrastructure.
2. You don't need to interface the kennel directly. There is for example a Google project (gvisor?) that acts as a syscall proxy in userland to combat these types of problems.
1. Docker is not synonymous with Linux containers. LXC for example has always had much better security than Docker despite using the same infrastructure.
2. You don't need to interface the kennel directly. There is for example a Google project (gvisor?) that acts as a syscall proxy in userland to combat these types of problems.