If the kernel you are running on is vulnerable, it can be attacked and the attacker can circumvent any container isolation.

If the hypervisor (Xen!) running underneath your container-Linux is vulnerable, the attacker can get access to your virtualized OS and circumvent any container isolation.

What a bright, shiny future we live in where "Docker!" is the answer to all problems.

Not immune to human error:

https://medium.com/@fun_cuddles/docker-breakout-exploit-anal...