Containers are tents
That's a valid way to look at it, but there are other ways. Containers are also a simple, practical way to bundle applications and their dependencies in a relatively standardized way, so they can be run on different compute fabrics.<p>That sense of the term isn't loaded with any specific notion of how attack surfaces should work. I think modern "Docker"'s security properties are underrated†. But you still can't run multitenant workloads from arbitrary untrusted tenants on shared-kernel isolation. It turns out to be pretty damned useful to be able to ship application components as containers, but have them run as VMs.<p>† <a href="https://fly.io/blog/sandboxing-and-workload-isolation/" rel="nofollow">https://fly.io/blog/sandboxing-and-workload-isolation/</a>