First: both projects are awesome.
My personal point of view is that, using OpenVZ since 2013, it is a great, easier and more secure experience, including the new OpenVZ 7.
Through the history of documented vulnerabilities from OpenVZ and LXC:
- From the three vulnerabilities found on OpenVZ, even when they were not fixed, they didn't allow privilege escalation
- From the eight vulnerabilities found on LXC, one documented on 2019 allowed code execution with root privileges on the host machine and other allowed privilege escalation
Some additional points:
- The venet network model of OpenVZ is more secure and more isolated 1
- A container on
venetnetwork (OpenVZ) cannot sniff the network traffic of neighboring containers 1
1 https://wiki.openvz.org/Differences_between_venet_and_veth
As stated in this article:
OpenVZ does security via the "bottom up, all included principle". Containers are very solidly isolated against each others. Over the years there have been a few issues and vulnerabilities, but in general you can say that they did a splendid job. Because security was first and foremost on their mind. Not just the container isolation, but also network security. If you allow root access to an untrusted client on one Container, then you don't want him sniffing the network traffic of neighboring Containers, the node or even the whole subnet. For that reason OpenVZ had introduces the "venet" network interfaces, which tackled that in a really neat, orderly and (for the end user) very simple fashion.