I think the website states it well:"Say goodbye to VMs
Unlike traditional IaaS where containers run in VMs, you will only work with containers in HYPER_. However, containers are protected by hardware-enforced isolation, meaning that they are as secure as a VM."