CVE-2019-5736: runc container breakout
&gt; However, it <i>is</i> blocked through correct use of user namespaces (where the host root is not mapped into the container&#x27;s user namespace).<p>In other words, this won&#x27;t affect anyone who understands the implications of running a process as root.  Unfortunately, the sad truth is that most people I&#x27;ve come across who have &quot;lots of experience&quot; with implementing Docker containers, do not even understand the basics of how they work, let alone the implications of root access.  I&#x27;ve interviewed candidates who claim to know Docker but can&#x27;t even tell me how Docker differs from traditional virtualisation or how it achieves its isolation.  The best explanation that most of them come up with is, &quot;Docker containers are more lightweight&quot;.<p>This sort of vulnerability should have been a non-issue but it has gained attention due to the sheer amount of incorrectly configured containers in the wild.  This was an accident waiting to happen, and I doubt we&#x27;ve heard the last of this sort of thing.