You could break out of the isolation by using kernel vulnerabilities, e.g., in syscalls.

Theoretically, nothing. In practice, the isolation it relies on is somewhat weak. And in general, it is new and exciting and changing frequently, which means security bugs. Also, most people seem to rather suck at configuring it, as far as I've seen. (That's not per se a problem with Docker, but it is frequently a problem with Docker as-deployed.) And then there are potential kernel bugs.

When talking about "trusting X", one always has to answer the question "trust X to do what, exactly, under what circumstances?" I don't yet trust Docker to be secure enough for production, internet-exposed business use. I know other people disagree; YMMV.