Matthew Garrett considers the security of Linux containers on his blog. While the attack surface of containers is likely to always be larger than that of hypervisors, that difference may not matter in practice, but it's going to take some work to get there: I suspect containers can be made sufficiently secure that the attack surface size doesn't matter. But who's going to do that work? As mentione