A container is not a lightweight VM

Explains why container isolation is genuinely weaker than VM isolation, and introduces distroless images as an aggressive hardening technique.