Containers (which are more than just cgroups) are supposed to be secure.<p>In practice, the attack surface is much bigger for containers than VMs, so there are far more &quot;break out of container&quot; vulnerabilities out there than &quot;break out of VM&quot; vulnerabilities.<p>Most containers are run in a VM, usually one being run for you by Amazon or Google.