How well are containers isolated from the host OS? Can a program escape from within the container? Can it then peek into other containers?