In case anyone else is wondering why you'd not just use LXC:

https://cloud.google.com/blog/products/gcp/open-sourcing-gvi...

That said, they don't quite go into the details of what type of isolation is missing from standard containers - I'm curious. It does seem like it would have been ideal for everyone if LXC would have had better isolation, rather than having to run a userspace kernel emulator thingy for each container, but c'est la vie!