You've cited kernel 3.1.5 which was literally a couple of years ago. As for the rest of your resources, they are LXC without Docker. Docker is the special sauce that makes MongoDB WebScale.

No really... if Containers are not for security, Namespaces and CGroups are. I won't pretend to know what SElinux does, or exactly how all of this works, docker does not purport to be production ready, but I would think that sharing the box with someone else would be the fastest way to find out if it can be broken.

(Upvote for at least showing some good research.)