I find it somewhat amusing that it uses QEMU to emulate Linux in order to create a container with restricted permissions, even though it is already running on Linux with restricted permissions. I get the point while it is designed that way, but still funny.