Absolutely, and in most cases (while one shouldn’t rely on this since escaping a docker container is sometimes doable) even if there is a security breach the invader would be limited to the service image, which would get recreated upon restart.