Earlier quoted context omitted.
Containers don't actually run directly on hardware with GCE - there's still a virtualization layer in-between. I'm 99% sure that Google runs one VM per container because that's the only way to make it safe. Anything else would be insane.
1 container per VM? What's the point? If you can bypass container sandbox it's very likely that you can do the same with VM.
Hypervisors are much, much harder to break out of than a Linux container.