"they accomplish the same goals as full VMs in a different way." They are explicitly not that. Docker containers do not provide you any real isolation guarant

"they accomplish the same goals as full VMs in a different way." They are explicitly not that. Docker containers do not provide you any real isolation guarantees from a security POV and make no attempts at such. This is extensively documented. [1] "If you're running Docker in a VM on a bare metal server you're doing it wrong. " Ummm... Running Docker inside a VM is by far the most common deployment type of Docker there is. What do you think is an EC2/ECS/GKE deployment? Hint, there's a VM running your containers in all of them. This is also what Docker the company recommends - https://www.docker.com/blog/containers-and-vms-together/ https://www.docker.com/blog/containers-and-vms-together/ [1]: https://docs.microsoft.com/en-us/virtualization/windowscontainers/about/containers-vs-vm https://docs.microsoft.com/en-us/virtualization/windowsconta... https://www.redhat.com/en/topics/containers/containers-vs-vms https://www.redhat.com/en/topics/containers/containers-vs-vm...