It is shared kernel, separate userspace. It uses: X-namespaces (network, pid, user, ...) and cgroups to separate those userspaces from each other. I have comm

It is shared kernel, separate userspace. It uses: X-namespaces (network, pid, user, ...) and cgroups to separate those userspaces from each other. I have community server running debian in which there are 10+ LXC containers running in which people are given normal root access, one container per user.