[j_s]

I recommend to at least wrap all the containers in a VM between the docker containers and your server-side orchestration code.

SELinux also helps, from what I've read.

https://news.ycombinator.com/item?id=14245428