I assume they meant using an OCI image for the rootfs of a firecracker VM, not running a container inside a firecracker VM.

Still difficult to see how the unikernel could be slower, but I doubt the difference would be huge? Don't have anything to back that up though.