Earlier quoted context omitted.
It didn't help them that they rejected the traditionally successful ways of monetizing open source software. Which is, selling support contracts to large corporate users. Corporate customers didn't like the security implications of the Docker daemon running as root, they wanted better sandboxing and management (cgroups v2), wanted to be able to run their own internal registries, didn't want to have docker trying to f…
Unfortunately even podman etc.. are still limited by OCIs decision to copy the Docker model. Crun just stamp couples security profiles as an example, so everything in the shared kernel that is namespace incompatible is enabled. This is why it is trivial to get in-auditable communication between pods on a host etc…
Which parts of the model are you referring to ?