Comment by coppsilgold

> Containers and namespaces are not about security

An escape from properly configured container/namespaces is a kernel 0day. Or a 0day in whatever protocol the isolated workload talks to the outside with.