When would you deploy a workload in a virtual machine rather than a container? Make the case both ways.

1. State the structural difference: a VM virtualises hardware and runs its own kernel; a container shares the host kernel and isolates via namespaces and cgroups. 2. Derive the consequences: containers start in under a second and cost megabytes, VMs boot in tens of seconds and carry a full OS. 3. Choose VMs when the isolation boundary must survive a kernel-level escape, when you need a different kernel or OS, or when a compliance regime requires hardware-level separation. 4. Choose containers for scale-out stateless services, fast deploy and rollback cycles, and dense packing. 5. Name the middle ground: microVMs (Firecracker) and sandboxed runtimes (gVisor, Kata) give per-tenant kernel isolation at close to container startup cost. 6. Apply it to the multi-tenant case: running untrusted customer code in a shared-kernel container is the wrong boundary, and this is where microVMs earn their cost. 7. Note that in practice both are used together — containers scheduled onto VM nodes, with the VM boundary drawn around the tenant.