Google has created a hardened KVM that it is using. So the GNU/Linux instruction run native on the processor but just sandboxed from the Linux kernel used by

Google has created a hardened KVM that it is using. So the GNU/Linux instruction run native on the processor but just sandboxed from the Linux kernel used by ChromeOS. Then they use containers between the GNU/Linux applications. This is different than how they did Android. Android is done using the same kernel as ChromeOS and using containers. But it is locked so can be secure. Google implementation of GNU/Linux is going to be far more secure. But all of this is hidden from the user. From the UI standpoint the user has no idea what is happening under the covers. You install a GNU/Linux application and it is added to the app drawer like an Android app or anything else.