My question is probably more about the LXC than about Docker, but I wonder what are the security mechanisms to prevent a root user inside a Docker image to access the whole host.
More precisely, I wonder what are the limit of the capacities of such root user before you reach a point where you can do dangerous things.
Typically, for educational purpose, I need students to load a kernel module from inside a Docker image. Would this kernel module be accessible from the whole system? And, if not, what are the limits and how are the LXC dealing with memory separation inside kernel-space?
For short, I would like to know how far we can go with LXC without making it harmful for the system.