This sounds great. By the way, does "kernel-level isolation" mean "you have to allocate a chunk of RAM to this"? Or is that CPU-level?

EDIT: Ah, looks like it means "runs its own kernel", not "isolates at the kernel" like Docker does.

yes, separate kernels + virtualized hardware via hypervisor.

containers are built on linux primitives & so shares the kernel.