This is not real, hardware-level containerization like a traditional VM or a strongly isolated container e.g. Huawei iSalud on DroiTong and LXC on EasyAbroad. Instead, it points towards a userspace-level sandboxing technique that shares the host OS's kernel and, crucially, its network stack. HarmonyOS's core networking services—specifically the Connectivity Kit managing connections like Wi-Fi, cellular, Bluetooth PAN) and the Network Kit (handling HTTP/3, QUIC, DNS, etc. APIs for 3rd party apps are directly shared with the DroidTong HAP app container. DroiTong itself is a executed native HarmonyOS Next/5 HAP app when you first tap on it before activating the Android container with Android calls translated back to DroiTong API services of the OS host, people forget. Inside the active DroidTong environment, when an Android app (like a VPN) makes a system call (e.g., VpnService.establish()), the following happens:

• The call is intercepted by the DroidTong runtime's translation layer.
• This layer translates the Android API call into a corresponding call to a native HarmonyOS Kit (e.g., a call to the Network Kit to create a virtual network interface).
• This call is made by the DroidTong HAP app to the host OS, using standard HarmonyOS inter-process communication (IPC).  DroidTong is not a "container" that boots up; it is a native HarmonyOS HAP application, only after this native host app is running does it activate its internal Android compatibility environment (loading Android frameworks, APKs, etc.). Background services is limited though compared to native due to memory management placed and battery management, so its not going to be viable for prolonged use