CVE-2019-5736: runc container breakout
For better isolation check out KataContainers: <a href="https://github.com/kata-containers/runtime" rel="nofollow">https://github.com/kata-containers/runtime</a><p>It's a drop-in replacement for runc. With KataContainers it runs docker containers in a lightweight VM so you get all the security benefits of a VM. The downside is slightly slower container start up times and might not work in nested virtualized environments.