Why do you need to access the OS? If you break out of the web server, you have control of the container. You can then launch any sort of internal attack at the access level of the container. You could also launch a DDOS from the container.

Most of the bad stuff you can do when you take over a web server doesn't require root access, just user level access, and you get that whether or not it's in a container.