And without the security benefits of proper virtualisation, too. At least lxc since recently has the ability to run containers as a regular user, but I'll stick to KVM guests secured with MLS policies for now.
Because the guests have their own SELinux policies. Docker containers don't come with policies, but if it would support running containers under a user account I could at least restrict each to their own category so that theoretically a chmod -R 777 / (inside a container) and access to the host wouldn't compromise other containers (unless the kernel is exploitable, in which case KVM would still win).
