I think BlackBerry use them on their Android kernels.
Docker is using Alpine Linux which normally uses grsecurity.
Does Docker boot a kernel?
Docker is just a beefed up wrapper around groups of processes on linux.
I know, but I've heard that it can run Linux on OS X, so I was wondering if it now boots kernels as well. Basically, Docker is ezjail with financial backing and PR.
On OSX its using a port of FreeBSDs virtualization bhyve aka xhyve to boot a Docker linux.
I'm not sure why they went with pivot_root -- there's already code to deal with handling symlinks and all of their paths properly within Docker containers from the host (which I helped write and merged something like 2 years ago). I would've thought the obvious way of doing it would be to modify pkg/archive ...
That doesn't give you any improvement in the container by default. Only the host's kernel matters in case of grsec.
Docker doesn't boot a kernel. It uses host kernel features. People who use alpine as a base for Docker images are just using the root filesystem from an alpine install.