Comment by goodpoint

Containers share the whole kernel (and more) so there's a massive attack surface.