Docker provides virtually no security guarantees on its own and container rights escalation vulnerabilities are a serious threat vector. The default containers provided by many applications are often insecure and ignore recommended security hardening practices. Seehttps://kubernetes.io/docs/concepts/security/overview/ 4 c's of container security.

Sadly it doesn't - Docker isn't specifically designed as a security tool and there are plenty of warnings against using it in this way.

Firecracker is the best I've seen in terms of container security - it was designed by AWS for Lambda and is trusted by people I trust. It's not really packaged for easily running on macOS etc though.

Docker actually worsens this. The default installation of docker makes no effort to prevent host root access from a container. Root in container is root in host