CVE-2019-5736: runc container breakout
For better isolation check out KataContainers: https://github.com/kata-containers/runtimeIt's a drop-in replacement for runc. With KataContainers it runs docker containers in a lightweight VM so you get all the security benefits of a VM. The downside is slightly slower container start up times and might not work in nested virtualized environments.