With virtual machines, the separation between what different customers get is quite straightforward.

With Docker containers, how do you solve this separation?