If the same compromised app is running natively then the entire system is now compromised. Capabilities and namespaces can be used with or without containers.

Yes, it does.

1. Every system has vulnerabilities. You can defend against them.

2. Any improperly configured system can be abused. In particular, the exploit you linked can be completely stopped with a litany of ways. https://news.ycombinator.com/item?id=16030107

Your argument going from "containers are unfit for production, you'll mature out of them one day" to "here's a small, preventable vulnerability" seems more like a security non-sequiter than an actual argument against containerization.

Further, claiming containers are not production ready is empirically and literally negated by them used, in production, by the largest tech companies that have ever existed.

Most operators lock down to the runtime pretty tightly, leaving very few capabilities enabled.

If that's not enough, it's easy enough to ensure that a Pod is scheduled to run by itself in an otherwise unoccupied VM.

If that's not enough, the IaaS providers can be paid extra to ensure yours is the only VM on the physical machine.

You can have the same expensive guarantees, if you need them, but with a uniform control plane for all workloads. That's pretty attractive.

You can't just "enable multi threading" in a varietal ecology of software applications and contexts.

Also, this is not an argument _against_ containerization. You make no argument or show any evidence of performance benefits bare v. docker.

We max out our compute about 3% of the time, and run at about 10% load the rest of the time. It's a similar story for memory consumption. And we run this multitenanted, where the max doesn't overlap for different tenants. And we can't move our customer data out of our data centre, so we can't use cloud elastic compute.

It's in this kind of a world that elastic compute provided by a cluster scheduler with efficient packing looks really appealing. And our jobs, while meaty in time and space, are stateless once the initial data is poured in, up until the results pop out - they are big functions, basically. Good match for a stateless container.

So k8s looks quite attractive.

That's ... not even wrong.