Docker
Containers Share a Kernel and That Is the Whole Story
The difference between a container and a microVM is one sentence long, and almost every isolation decision follows from it.
Isolation boundaries, untrusted code, sandboxing and the difference between a configuration that looks safe and one that is.