Docker allows to isolate a process at multiple levels through namespaces:
- mnt namespace provides a root filesystem (this one can be compared to chroot I guess)
- pid namespace so the process only sees itself and its children
- network namespace which allows the container to have its dedicated network stack
- user namespace (quite new) which allows a non root user on a host to be mapped with the root user within the container
- uts provides dedicated hostname
- ipc provides dedicated shared memory
All of this adds more isolation than chroot provides