It might be better to look at rkt with a kvm backend if you want&#x2F;need real isolation and resource limits. Maybe docker will provide isolation&#x2F;security at some point, but the core differentiating thing about Docker vs OpenVZ etc is <i>ease of use</i> -- explicitly forgoing much of the security and isolation possible in the underlying technology.<p>From what I&#x27;ve seen, trying to bolt security and isolation back onto Docker is generally a bad idea.<p>That said, when people have done the work to make microservices deployable under Docker, they have in general laid the groundwork needed to run these services in a truly isolated environment. So in that respect Docker is great; the effort to run something that works in a minimal Docker container in a jail&#x2F;chroot&#x2F;vm should be much less than starting from scratch; a lot of the assumptions about resources&#x2F;dependencies should already be fixed.