So this is pretty misleading. It's really a full system emulator (qemu) running inside Docker, using root privileges on the container that make the isolation very weak (--privileged). It also uses hardware assisted virtualization (KVM) which is not going to be available most of the time Docker is. You can think of the Docker platform itself as subset of the Linux platform. With many common features removed by default…
its using docker as an artifact delivery mechanism, not as an isolationism mechanism.
I an not saying it’s right or wrong. I think it’s the most practical and thus most pervasive use of docker.
The company and the project provided a great service by creating lot of shipping/container related metaphors though. That’s very much invaluable in my book. Providing thousands of developers means to talk about objects that are static and dynamic from an architectural perspective.