On: How we run Firecracker VMs inside EC2 and start browsers in less than 1s

[cute_boi]

It is security boundary but a weak one. Escaping from docker is very hard.

[rvz → cute_boi]

> Escaping from docker is very hard.

You mean a microVM.

A docker LPE (local privilege escalation) requires a kernel exploit such as Copyfail would work under docker but not in a microVM.