My impression is that someone created a specific dockerfile to get around the issues. I'm noting that LXD can run, for example, stock debian.
This appears to be a fairly complex subject. See https://news.ycombinator.com/item?id=11216950 and the original LWN article that it depends from.
PS.
Try it: