Document security implications of using rootless containers

"Docker containers are, by default, quite secure" (cite) - runc containers (at least how they are configured in Docker) try to be quite secure for running untrusted code.
It is possible to drop all capabilities, run process inside container as non-root user, etc, and have good enough sandbox for untrusted code (of course with lots of nuances, attack vectors and not found/disclosed vulnerabilities of the Linux kernel).

What are security implications of rootless containers?
Is processes in rootless container are well confined to run untrusted code (in ideal world when there is no vulnerabilities in the Linux kernel)?
How processes from rootless container can influence host system or user processes outside container?

For example, I see that cgroups are not always configured for rootless container, this probably means that process inside rootless container can start fork-bomb and exhaust host resources (just an example, not sure is this true).

It would be nice to have this documented.

Start with the linked Docker security conclusions and the issue's questions about rootless containers, cgroups, capabilities, and host or user-process isolation. Determine what can be documented about confinement and resource exhaustion, then produce documentation that clearly explains the security implications and limitations.