Maybe so, but somehow containers aren't really there yet. As a trivial example, when I 'lsof' a container process (as root), it often cannot "see" all of the information about the process' open files, apparently because they're mapped into a different chroot, or because of other cgroups/namespace issues.

This is one of a number of issues that make containers hard to deal with.

(We also see an issue where containers interact badly with the OOM killer, leading the entire system to hang because /proc/*/cmdline cannot be read at all.)