"While Linux Container systems (LXC, Docker, CoreOS Rocket, etc) have undergone fast deployment and development, security knowledge has lagged behind. The number of people focused on container security...seems disproportionately small"
I agree with this part. Most containers aren't running as an unprivileged user. Those environments that do support it only support it in a very limited set of os/kernel/whatever versions. Somewhat concerning since containers are getting traction almost everywhere.
Oddly enough, quite a few people in the runC community (including myself) are working on implementing the ability to start containers without root. If we can get this to work, it will be brought to Docker and you'll be able to start containers without even needing a daemon running as root (although you'd lose some functionality due to deficiencies in some of the kernel interactions with user namespaces -- but it should be more secure than it is now). It does bother me that the Linux kernel community entirely ignored other container implementations.
If you're interested, I've got a WIP branch of runC that actually implements working rootless containers. This is really exciting. I'll be writing a blog post soon.
I agree with this part. Most containers aren't running as an unprivileged user. Those environments that do support it only support it in a very limited set of os/kernel/whatever versions. Somewhat concerning since containers are getting traction almost everywhere.