Linux containers vs. VMs: A security comparison (InfoWorld)

we have actually some features that guarantee that entire bug classes are no longer exploitable (for privilege escalation that is, reporting+reaction usually means some form of DoS but that's inevitable).