Using runsc instead of runsc means that there's a hypervisor layer (gvisor, probably) in-between the kernel and the container userland