README: citation needed about bubblewrap HOT 3 CLOSED

These are not contended statements, ask any docker developer (me for instance), or look in the docker manpage for instance. For instance, the docker run with --privileged and -v /:/host_root will give you full privileges and access to the full host filesystem. systemd-nspawn similarly lets you set up minimally contained container (of course, systemd-nspawn requires you to be root to run it, so its not technically a privilege escalation).

from bubblewrap.

For instance, the docker run with --privileged and -v /:/host_root will give you full privileges and access to the full host filesystem

Running everything with --privileged is simply misconfiguration, not an architectural problem, even less a vulnerability.

from bubblewrap.

I don't understand what you mean by that. If you give your user access to the docker socket he can use --privileged to get access, there is nothing unexpected or "vulnerability" in this. It is just something implied by having docker access. But, that also means you can't generally give out docker access to users you don't trust with root.

from bubblewrap.