>what is the benefit to any isolation of a process for a single tenant?
Build, test, and ship the same artifact. Whether it's a Vagrant on your Mac, AWS, or metal in your colo datacenter.
>and why cant you just run cgroups without the overhead of docker ?
If you're running cgroups, you've created your own half-baked implementation of Docker in giving yourself a reasonable API to work with. This might make sense if you're Google but otherwise probably not.
