Containers vs Hypervisors: The Battle Has Just Begun (Linux.com)

But as soon as there is uptake on the idea, things will get standardized, and that opens the door to abusing standardized APIs or standardized setups. And if the storage layer is replaced with cloud storage APIs, you have to include the attack vectors against the cloud storage as well.

Things do not become necessarily less complex, but it might help to reduce the number of (currently used) attack vectors.

And full virt VMs are reasonably fast if they are reasonably set up.

This is probably one of those things not worth having a war over - some times containers will be better, some times VMs will be better, but most times either one will do just fine, and pretty much interchangeably.

I don't think that is true at all, what I've heard from the security people and the container people is that containers are not useful for hostile multi-tenant environments, in the way that full VMs are useful. There are too many design holes which need to be plugged with SELinux or seccomp_bpf or whatever, the kernel attack surface is large and there are _always_ 0days floating around which break the kernel, especially when you support fully-featured guest images. Of course this doesn't mean that hosting services aren't being offered, but what you believe is "reasonably secure" may differ from others.