> Ubuntu has the exact same vulnerability out of the box, just with lxd instead.

No, it does not[1]. LXD:

- explicitly warns against this mode of vulnerability. Of course, there's no protection against people who blindly run commands copied from the internets, but the official documentation, at least, for as far back as I can recall, has had clear warning boxes against this, with explanations.

- does not have the track record of bad design that docker has had (IMO).

- supports fine-grained ACLs and user management.

----

[1]: https://ubuntu.com/blog/shared-development-environment-with-...