They don't use Linux container, they use hypervisor-based container (see: github.com/hyperhq/hyperd). Therefore it is VM-level isolation.