CoreOS and SELinux together is pretty secure if set up properly; even if you broke out of a container you wouldn't be able to do anything, even start a process. But still, yeah, in a unikernel there is no 'breaking out' at all.