Essentially this. In theory it could be done, but I've only seen placs where they wound up with a app-container-per-production-WAR rule.

OS containers are a similar pattern for a similar reason. Stronger isolation simplifies production deployment and management.