A virtual machine (or better) is better suited to this task.
Also, the memory footprint of several virtual machines isnt that bigger compared to docker - because of KMS and such.
I would be interested in learning more about the differences in management software availability as well as how KMS (KSM?) reduces the performance penalty of using virtual machines.
No.
Containers are and can be secure, perhaps even more so than QEMU/KVM Id argue, see latest lxc - you can run it without root and with seccomp syscall whitelist (if not in lxc that feature is in firejail, or a simple .c to setup yourself).
Its only docker that is fundamentally insecure. First it runs a server as root, second it has a server-client architecture with quite complicated communication between them. Then it also has an API and talks to various indexes/registries, also vector of attack.
With say firejail, its only one process, no server-client, no registries, the whole thing is in a few hundred lines of C.
The performance penalty - is somewhat bigger memory usage - and startup time, thats it, with hardware accelerated virtualization which most computers have these days, the performance impact once the VM is up and running, is negligble.