Also, most running containers don't also run inside full blown VMs per se, but there are multiple layers of security/sandbox technologies involved.