Hacker News Reader

Maybe you read the opposite, i.e. that GCP's KVM virtual machines run inside Borg containers?

Also, most running containers don't also run inside full blown VMs per se, but there are multiple layers of security/sandbox technologies involved.

Mostly upstream KVM with a custom replacement for QEMU:

https://cloudplatform.googleblog.com/2017/01/7-ways-we-harde...

Lots of bits of KVM turned off, though. Makes it really interesting when I work with people on Open Source stuff. I find out all sorts of things KVM can apparently do that mostly leave me going "you put WHAT in host ring zero?!" :)

(note: as implied, I work on our userland QEMU replacement)