Insecure is a very strong word, world has been running on Docker for sometime and it works fine and is not as insecure has you seem to think.

I agree that Docker actually has a relatively good track record, but it is true that Docker will never be on the same level as a VM hypervisor that was designed from the ground up to be a security barrier.

Thus, when people bring up "Docker is insecure" I try not to get down in the weeds arguing about the specifics, and instead point out alternative projects that are designed with security in mind. I find it's a much stronger counterargument.

The world does not rely on docker for security at all, cloud providers put each tenant of container runtimes behind an additional barrier, like a VM.

Secure runtimes are a superior solution to virtualisation and separate kernels. There are only two secure runtimes in common use - for javascriot and webassembly.

The point about hardware support is very unfair - if you invest the same level of effort and hardware support into webassembly, you can also i prove its performance. Thats like compaining that electric cars suck because there are no chargers - its just infra.

I think that security has always been a goal of FreeBSD jails and I believe they are a bit more hardened than docker

Docker only uses namespaces and cgoups.

Docker does not provide and security or isolation.

To have security and isolation with Docker you must use something external like SELinux or AppArmor.

Hope that helps.

Regards.

Docker also uses seccomp.

> Docker only uses namespaces and cgroups.

How is that not isolation?

The docker daemon has basically root over your system, so any escape can end very badly.