Tell me again why a properly managed container environment (if you wanna go bonkers use Jails on FreeBSD) offers more attack surface than multiple operating systems running the exact same software.

Just randomly mentioning ISO27x tells me exactly that you have absolutely no idea how those standards work.