CPU Cache contention, network overhead introduced by Kubernetes service proxy model, even the liveness checks.

We haven’t yet evolved Kubernetes services to prefer specific cores and avoid app workloads quite yet (although cpu management is getting closer).

Docker is also somewhat hefty memory wise and you may contend on disk if not careful.

5% seems pretty reasonable to me in general, just as a consequence of having something heavier weight on the same node managing workloads.