Kind of a crazy concept in modern days: instead of running your application inside an Operatin System; your application pulls the full operating system and runs alone in dedicated hardware or Virtual Machine I assume. So you end up with something lightweight and with a much smaller attack surface area.