Trying to understand how project isolation works in a SAAS platforms.

By project, I am talking about a "virtual" instance. I get to use a computer on their server, but how? Are those virtual machines, or containers?

If the former, then why - given how virtual machines have a large overhead? If the latter, then containers have a low degree of isolation compared to VMs, right? I've also heard about K3 and K8 before, but I don't know exactly what they are, and what role they place here.

And speaking about either of them - how are they introduced through a backend - by using bindings? Or is there a port-equivalent to pass instructions, similar to how we connect to a database?