Are cgroups meant to be secure against malicious code trying to get out and install rootkits on the underlying system?<p>AFAIK, hardware-level virtualization is. If code running under Xen can get out, that&#x27;s considered a bug in Xen and it gets fixed, right?<p>OTOH, chroot is not considered to be secure. It isn&#x27;t designed to be secure. It is not a security tool. Code in a chroot jail is expected to be able to leave without subverting the security mechanisms which, by and large, don&#x27;t exist in the first place.<p>So, are cgroups Xen or chroot?