[tptacek]

People say this a lot too, but Illumos also uses shared-kernel isolation. Linux + gVisor is probably (significantly) superior to it as far as security goes.

[yjftsjthsd-h]

90%+ of Docker users aren't using gVisor; I don't disagree that it's good, but it feels like an aside.