First thing I heard about it too, apparently docker has VMs now?

Each agent runs inside a dedicated microVM with a version of your development environment and only your project workspace mounted in. Agents can install packages, modify configs, and run Docker. Your host stays untouched. - https://www.docker.com/products/docker-sandboxes/

I'd assume they were just "more secure containers" but seems like something else, that can in itself start it's own containers?