Comment by dredmorbius

Containers (and virtualisation) are helpful but. not bulletproof. If your threat model is already malicious code with ill intent, you probably want higher grades of privsep / sandboxing.

E.g.,

https://www.twistlock.com/labs-blog/escaping-docker-containe...

https://www.exploit-db.com/exploits/46978

Full virtualisation does far better, though I believe there've been exploits there as well. Yes, from 2015:

https://threatpost.com/xen-patches-7-year-old-vm-escape-hype...