Currently experimenting. The idea is to isolate any services where I'm not confident yet in their security/quality. The hope is that if there is an exploit in a given service that an attacker won't be able break out of the docker container and cause damage to my systems.

An example of a service I would isolate in a docker container would be a minecraft browser map application I use. I don't know who wrote it, I don't know who's vetting it, I don't know the source code. I would feel a lot better putting this in a container before I expose it to the internet.

I believe I will follow this process for anything that's not properly maintained (not in an trusted apt-repo or some other sort of confidence)

We are testing out docker at the moment, building images from successful staging builds for all our APIs. Since we operate in a SOA (not quite microservices), developers have a dockerfile that they can run to build the entirety of our api infrastructure on their machines. We use the successful builds from staging to power these instances allowing them to do some more manual integration testing across systems.

Docker is used for local development along with boot2docker and VirtualBox as described in Simple websites with Jekyll and Docker. It's also used on the server to build and house the site. Additionally the container is hosted free with automated builds on DockerHub.

Each component of the app was launched in a separate container, so that they wouldn't have to share resources: the front end in one, the back end in another, a third for celery, a fourth for celery-beat, and a fifth for RabbitMQ. Actually, we ended up running four front-end containers and eight back-end, due to load constraints.

Linux containers are so much more lightweight than VMs which is quite important for my limited budget. However, Docker has much more support and tooling for it unlike LXC, hence why I use it. rkt is interesting, although I will probably stick with Docker due to being more widespread.