That's just saying how people tend to use it, not what the technology does. Namespaces/Cgroups can be used both ways, to isolate a single process (or even partially-isolate individual threads) or entire userland stacks.

The question that was asked what the technology can do, not how it's being used. What are the primitives, the atoms its made of.