yeah but that bit of complexity wasn't mentioned :). If every process you need to run in it's own VMs/per-instance then you've got best-in-class isolation already, no need to bother with containers, and you can get your resource and namespace isolation. Not quite the same as just throwing a static binary over the wall though, a little bit more complexity there.