[dispose13432]

While containers can't help against privilege escalation, they help against information leakage.

For example, even assuming privilege escalation isn't a possibility, www-user can read /etc/passwd, getting all usernames. Containers help mitigate this.

[module0000]

If your www-user can read /etc/passwd without 'avc: denied' appearing in your selinux log, you are doing it wrong.

The whole idea behind selinux is to prevent this scenario from ever happening. Apache has a policy written for it, that specifies precisely which paths and contexts apache needs <X> type of access to. If it tries to access anything outside those paths and context, the selinux module denies the attempt. It's foolproof if you use it. It's also incredibly annoying if you are on a system with selinux enabled, but aren't familiar with selinux.

[dispose13432]

It's true, but containers are much easier to play with if your distro doesn't come with sane presets (Debian, for one)

[geggam]

... because you are auditing all of the upstream image sources ?

seriously ?