Containers are for security, but they rely on the kernel+ being secure. VMs rely on the hypervisor+ being secure.