GSGBen parent
Not sure if this is still true RE: Azure. AFAIK they use Hyper-V (hypervisor) containers which offer kernel isolation like other lightweight-VM-container runtimes.
Hyper-V has been around for a while, did Azure just not get the memo until recently?