The most commonly mentioned flaw was/is the root daemon. That can be worked around with other tools. The command line and docker files are a bit clumsy as well. Many images have security flaws. It didn’t clean up after itself for a looong time, etc.

It doesn’t “suck,” and many of the ideas are compelling. But, the design and implementations could be better. I was interested in rkt until it was acqui-abandoned.