Apologies for the confusion - I assume call-with-container talks to the required kernel functionality directly instead.