The main primitives that underlie Docker were originally intended to facilitate security and isolation. Docker's innovation was combining filesystem-in-a-box with those security primitives, and delivering all those capabilities with highly intelligible UX. That's not meant to minimize; I think those are monumental (and monumentally impactful) achievements. But there was no "re-pivot" to secure sandbox isolation; that's what things like cgroups and namespaces were created for!