(I'm a co-author of the blog post) Many functions of the kernel are still effectively shared: memory management (e.g. reclaim, swap), thread scheduling, etc. T

(I'm a co-author of the blog post) Many functions of the kernel are still effectively shared: memory management (e.g. reclaim, swap), thread scheduling, etc. The application is simply limited in its ability to interact with the shared kernel, and functionality related to system APIs is isolated. Arguably I think this is closer to the ergonomics of containers, but with compatibility and performance trade-offs.