is this true?<p>I understand that the attack surface of a cgroup based container is bigger than a VM, but saying that just running processes as root in contains is not more secure than chroot begs at least for some reference.