Rocket, a new container runtime from CoreOS

> running primarily as root on your server.

This is even worse. There are management images that ask to pass the docker daemon socket into the container. They use that, for example, to collect logs for all containers. As a result people get used not only to run randomly downloaded images but also run random images that can trivially get full root access to the host.

On the other hand an apparent docker success implies once again that one does not need to provide any security to be popular.