Linux containers vs. VMs: A security comparison (InfoWorld)

In case my original comment wasn't interpreted the way I intended (that's at least the case for Brad, so maybe also for others), I wasn't implying at all that grsecurity was incompatible with containers, quite the opposite actually.

My point was more like grsecurity and containers are orthogonal to each others, and that might be the reason (pure speculation though) the original article didn't mention it.

The one place where they're not orthogonal features is with RBAC (which can be used to isolate processes a bit like containers do), and that also means it's really hard to have specific namespace support.

I stand corrected about the chroot restrictions though, that's nice.

And obviously, like Brad said on the last paragraph, since you share the same kernel on all the containers, you actually really want to protect it against the various userlands, and thus having a hardened kernel is definitely a good idea here (on top of generic container hardening like capabilities dropping, seccomp etc.). I do run some (LXC, not docker) containers and I'm glad I'm running them on a grsecurity kernel.