[marcosdumay]

Containerization doesn't protect at all against privilege escalation. And AppArmor is a very partial improvement.

The way to protect against this is with an external supervisor. But then you have to care about privilege escalations attacks against the supervisor. Hopefully that one is much simpler than Linux so it has much fewer vulnerabilities.