Most websites are quiet most of the time. Giving each one its own machinery would be like renting a whole house for someone who visits twice a year. So small sites share a building - one process, strictly separate data - and the platform watches each site's traffic. When one gets busy, it moves into a house of its own. When it quiets down for a couple of weeks, it moves back.
Sharing a building only works if the walls are solid. When a request arrives, the shared process looks at the address, then switches to that site's own database and settings just for that request (using Python's contextvars), so one site never sees another's data. Each site's container also has its own private network with an outbound firewall. And because owners can upload and edit their own themes, those templates run in a sandbox with limits on time, output and memory.
What counts as "busy" took a few tries. A single newsletter, or one crawler having a burst, shouldn't make a site look popular. So the score is the site's typical day over the past week (the median), plus how busy its busy hours are (the 95th-percentile hour), which ignores the handful of wildest hours.