"unlike Facebook Container, Multi-Account Containers doesn’t prevent you from opening non-Facebook sites"

and therein lies the problem; you can't restrict a container to a specific domain/domains - really guys?