I should think proper sandboxing of the rest of the OS should contain the mayhem to the process/container though.

I think most of us on HN understand that "safety" is something you just have to accept is never 100%.

As an example a team responsible for security can test the standard image libraries (libjpeg, etc.) using file-fuzzing to find any bugs around buffer overflows, etc. It's good they do this but we all know that this is still a statistical shot in the dark that may still leave a vector somewhere in the framework.