I haven't been paying attention recently, but last time I checked, there were no known escapes out of Solaris zones, while there are quite a few CVEs about escaping Linux containers and even QEMU/KVM/Xen.

The one escape out of FreeBSD jails that I'm aware of (CVE-2005-2218) involved not a bug in the jails code, but by burrowing out via devfs.

So it seems that OS-level virtualization/security has a better track record.

Yes, for a very long time the Linux devs were emphatic that cgroups should be not be treated as an actual isolation/security barrier. This was flagrantly ignored and like most things in the Linux ecosystem, the functionality was eventually kinda-sorta backfilled based on the community's refusal to accept anything else. Meanwhile, FreeBSD and Solaris had quietly provided coherent tools to accomplish the same ends securely for many years.

The story of the BSDs and illumos is really a tragedy about the complete and total disconnect between technical quality+value and technology adoption. People utilize technology products as fashion statements first and foremost, and the Linux fashion was easily the most desirable -- indeed, aside from PC v. Mac, it's the only one generally known by average technophiles.

As a technical entrepreneur, I've discovered the sad reality that it's really only the most superficial 10% of any functionality that drives virtually all adoption. Everything else is marketing, even in supposedly heavily-technical endeavors like running an open-source kernel. The more you invest in engineering beyond that initial superficial component, the less you have to invest in brand promotion.

One can choose to gratify their own sense of righteousness and ignore this, and that is certainly a valid option to take, but then they shouldn't be surprised to see their lunch eaten by someone who took the other side of the bargain.

I disagree.

Linux have 18 millions lines of code in drivers. It can run on almost any chip/architecture. Distributions are fully featured and most of the things you can imagine have first class support.

I do not care how beautiful is architecture of BSD kernel if I cannot run my code on it.

Write the drivers for your hardware and bootstrap it and it will be able to run. Wait a minute, wasn't that THE one and only answer for "my hardware doesn't run Linux!" from the early '90's all the way to 2005?

does Linux run on a toaster? ;)

> People utilize technology products as fashion statements first and foremost,

It's true that tech has a popularity-breeds-popularity effect, but I don't think it's mainly fashion (at least, for industrial use of tech like PLs used commercially), but network effects around available knowledge and skilled users.

Abstract technical superiority often isn't a commercial win without reliable availability of people able to use it effectively at costs that make it efficient. There's situations where buying the limited knowledge pool, or paying to grow on house skill, is worthwhile, but often the “worse” solution that is well-known is better practically

Are you counting kernel exploits not directly related to jails/containers as an escape?

Generally, if someone was in a guest jail/container, there was no way of them being able to either (a) get to another guest jail/container or (b) getting to the parent context.

That was true at one point in time (i.e., no known breakouts). I don't know if that is still true, and if it is not, when that breakout CVE was published.