Containers are running native code. iPhones, for instance, seem happy to run containers. And it's my (perhaps shaky) understanding that the multi-process model

Containers are running native code. iPhones, for instance, seem happy to run containers. And it's my (perhaps shaky) understanding that the multi-process model for browsers involves running processes with reduced privileges - containers, in other words, even if not specifically "docker" ones. AWS lambda is built on a VM/container hybrid IIRC. And VM's, again, have direct access to hardware. This is what this SR-IOV business is all about and how we (RoCE) can have remote disks across networks that run even vaguely well. Virtual machines have been running arbitrary code for a long time now, I think this is pretty much a done deal.