Yes, the QEMU process that underpins the hardware virtual machine lives within a container on the host. It means that a vulnerability in QEMU that allows for guest escape will land you in an otherwise empty container, rather than out on the host where other tenants are accessible.

But Triton is first and foremost about _container-based_ virtualisation: which involves no HVM at all!