gVisor can use KVM for isolation instead of ptrace, and I would guess that Google is using it.
AWS> we put your code in a container, like everyone else puts your code in a container. We bikeshedded the Linux distro a bit, so you might need to recompile
Customer> OK. Fine
GCP> our web scale open source userland kernel hypervisor written in Go hosts your code in a Linux-but-not-quite-Linux microservice
Customer> Why does <X> system call return a strange error code?
GCP> You're too dumb to understand. Trust us
Customer> oh, I think I understand well enough. Calls back Azure sales rep