Linux containers aren't rocket science, but the system call API is confusing and hard to get right (I find pid namespaces particularly annoying), the basic user commands (unshare, ip netns...) are kind of a pain to use, and orchestration using Docker/Kubernetes is overly complex and opaque. There is clearly room for improvement at all levels.