Docker breakout exploit analysis

Linux has had user namespaces for a while, and user namespaces solve this problem.

Yes, they have their share of bugs (I've found quite a few of them), but they're far better than doing containerization with funny cgroup games and crossed fingers (i.e. what Docker does now).