Why containers are less secure that virtual machine?

Containers actually shrink the OS attack surface relative to a full VM because they share the host kernel rather than running a separate complete operating system with its own services.

Container network isolation is configurable and containers can be placed on separate virtual networks, making shared networking a deployment choice rather than an inherent security weakness.

Disk space exhaustion is a resource management concern that applies to both VMs and containers and is not the primary architectural security distinction between the two.

Unlike virtual machines, which use a hypervisor to enforce strict CPU, memory, and I/O partitioning at the hardware level, containers rely on OS-level namespaces and cgroups that can be exhausted or bypassed. A compromised container can consume unrestricted CPU cycles, causing starvation for other containers and the host itself, because there is no hypervisor layer enforcing resource boundaries.