Making Containers More Isolated: An Overview of Sandboxed Container Technologies

In the case of this article, in the Docker section there's no mention of the Apparmor/SELinux policy that gets applied to containers and no mention of the seccomp policy that's used by default to constrain some syscalls from a running container.

My general take on it is that Docker/LXC provide quite flexible security models, which can be modified to suit a user's process (e.g. by dropping unneeded capabilities from the default set or adding a custom seccomp profile)

gvisor provides a higher level of security due to additional layers being in place and once the Google team move to regular releases with a support lifecycle, I think it'll be quite a good option where it works to provide additional isolation for production workloads (for some production environments, the idea of picking a nightly build to use might not fit too well)

One tradeoff to consider for things like gVisor/kata/firecracker is that they don't have the same composable security model used in standard linux containers, so it's not always possible to remove a single part of the isolation (e.g. running with host networking) whilst leaving the rest of it in place

And in contrast with another commenter here, I'm glad this was a to-the-point, no nonsense article - no stupid GIFs or too many cringey attempts at humour.