I support docker in its efforts. However, docker is too cute, too hyped, and too rapidly developed to trust with your security as yet. Quite frankly, you have to understand a bit more than how to call an API to have faith in your infrastructure's inherent security.<p>For example, in this article the author links to the 'list of dropped capabilities in the Docker code'. As it happens, I wrote that list quite some time ago, and wrote it for <i>lxc-gentoo</i>, a guest-generation script for raw LXC against an earlier kernel version with an earlier LXC userspace. Not only is the list now out of date, it's no longer using the preferred approach. Why is this? Instead of explicit drop ("allow all, deny some") after some months of raising the issue one of the LXC devs finally added the 'lxc.keep' (ie. "deny all, allow some") which is architecturally more secure against things like kernel upgrades which add or modify kernel capabilities.<p>Furthermore, the docker people only included this when I added <a href="https://github.com/dotcloud/docker/commits/v0.5.0/lxc_template.go?author=globalcitizen" rel="nofollow">https://github.com/dotcloud/docker/commits/v0.5.0/lxc_templa...</a> ... things as important as <i>WARNING: procfs is a known attack vector and should probably be disabled if your userspace allows it. eg. see</i> <a href="http://blog.zx2c4.com/749" rel="nofollow">http://blog.zx2c4.com/749</a> and <i>WARNING: sysfs is a known attack vector and should probably be disabled if your userspace allows it. eg. see</i> <a href="http://bit.ly/T9CkqJ" rel="nofollow">http://bit.ly/T9CkqJ</a><p>Again, I fully support docker's efforts but the article is ... misleading at best.