It provides no process or filesystem isolation at all.

It always emulates a complete physical computer with its own hardware devices.

Every container boots a separate kernel bundled with the application.

It isolates processes and filesystem views while sharing the host kernel.