[simonw]

Aside from my worries about container escape, my main problem with Docker is the overhead of setting it up.

I want to build software that regular users can install on their own machines. Telling them they have to install Docker first is a huge piece of friction that I would rather avoid!

The lack of network support for WASM fits my needs very well. I don't want users running untrusted code which participates in DDoS attacks, for example.

[benatkin]

You have the same lack of network support with cgroups containers if you configure them properly. It isn't as if it's connected and filtered out, but as though it's disconnected. You can have it configured in such a way that it has network support but that it's filtered out with iptables, but that does seem more dangerous, though in practice that isn't where the escapes are coming from. A network namespace can be left empty, without network interfaces, and a process made to use the empty namespace. That way there isn't any traffic flowing from an interface to be checked against iptables rules.