...
The manpage is man cgroups with an s. 
...
Process segregation with Namespaces and Capabilities
Inside a container, Linux compartmentalizes all processes belonging to that… Namespace. It’s like a label attached to the activities which were instantiated with that running container.
Specific privileges can be assigned to select containers running capabilities. This is similar to running a packet sniffer such as Wireshark (tshark) as an un-elevated Linux user.
...
Top 3 security concerns
Any docker host (such as a developer or DevOps workstation) which can (or does) run Docker containers as root is a privileged workstation or server. It can also mount the host operating system root and persist changes.
solutions: rootless Docker
Cfm footnote an.spaceKey AD text https://docs.docker.com/engine/security/rootless/ id 8p7cx1grtuj
Any security vulnerability that’s reachable from the ENTRYPOINT
process can potentially be reached with injection attacks from software exploits.Cfm footnote an.spaceKey AD text https://docs.docker.com/engine/reference/builder/ id yylk6jkirre solutions: Application Security including Supply-Chain security including SCA (Software Composition Analysis)
A container
Handy snippets
List dockerized processes
...