Bocker has a drastically smaller inherent software attack surface than mainline Docker, yet its container isolation is practically non-existent, making it way easier to exploit and break out of.