[jacques_chester]

> Docker is more and more becoming an API that sits on top of a bunch of other services.

Which is a good thing. With Cloud Foundry we moved from using a pre-Docker container engine to using runc as soon as it was available; containerd is the next move.

> Even so, "docker requires too many privileges" is marketing speak.

I don't agree. The API surface still exists and includes too many disparate purposes. The modularisation of Docker is improving that risk profile, but it still exists. Fully segregating the API and the modules is worthy.

[cpuguy83]

Modularization improves maintenance overhead, it does not reduce privilege.

[jacques_chester]

I understand that. My point is that it reduces the blast radius of any one part being compromised.