Docker is difficult to understand in-depth, and, at least in my career, I haven't met too many people who do more than just skim a blog post and then think they know everything about Docker. This is how you get Docker punching holes in your firewall[1] and everyone acting surprised, because they a) didn't read the docs and b) have no idea how firewalls work.

Docker's interface might seem simple, but it adds an entirely new layer of complexity, with semantics only superficially understood by the vast majority of its users, and nobody ever seems to talk about Docker's negatives. A good rule of thumb might be: if you can't accurately explain how Docker works under the hood, or if you don't understand the OS components Docker itself uses, you shouldn't use it.

[1] https://news.ycombinator.com/item?id=29576522