Aporeto's efforts in securing containers using Xen-based virtualization technologies are moving forward. After PVCalls, a new approach to virtual machine networking, we introduced a Xen transport for 9pfs. Exporting a filesystem from host to guest is an essential requirement for many containers engines. Together, the two protocols lay the foundation for VM-based containers. This talk will introduce the new Xen 9pfs protocol. It will explain its design and performance. The presentation will describe the best way to integrate Xen into container engines. It will discuss the challenges of introducing Xen support into CoreOS rkt, and provide an update on the upstreaming effort. It also will demonstrate rkt deploying cloud-native apps seamlessly as virtual machines on Xen, and detail the benefits of this approach and the differences with traditional containers deployments.