Honestly, on Linux we can reach a similar point now by careful application of existing tools. For example, by whitelisting syscalls, devices, hardware and network resources and access patterns, in combination with containers.

Most of the challenge is automating that process adequately, which is really nothing more than traditional code profiling meets existing policy-based kernel-level security toolkits meets containers meets development processes (ie. build/test/release).

After ~3 years' with LXC, I believe that most of the attack surfaces are reasonably well understood and/or not required for most code to function. Sure, there will be kernel-level vulnerabilities, but they won't be exposed to such a broad range of userland applications. With security you also get so much more insight, power and predictability with regards to resource profiling than with paravirtualized solutions. Real kernel-level metrics versus load! Think of the impact for operations/capacity planning.

So... short soundbite to summarize? Docker is a toy compared to where we are going.