Your own hypervisor, on your own metal, inside a container

The firmware team needs to test a kernel module that may panic the box. The container's shared kernel is the wrong blast radius for that.

You create the container with kvm: true on a rented server. On first start, /dev/kvm appears inside it, world-writable, so a non-root user can run QEMU. The team boots their own kernel as a KVM guest at near-native speed. When the module panics, the guest dies. The container doesn't. The other forty containers on the server don't notice.

On a cloud VM you'd be nesting virtualization inside someone else's hypervisor, if they allow it at all. Here there is no shared hypervisor for anyone to escape from, and nobody else's workload on the hardware. The hypervisor is yours because the machine under it is yours.