It depends on how you want to look at it.
In Docker, containers are basically child processes of Docker processes, and are additionally set up to be constrained by misc. kernel features like namespaces or cgroups.
So while the container processes might think they run on top of the kernel, it's an illusion set up by Docker and created by the kernel features.
And whether one thinks the illusion counts as a separate "Container Engine" layer is a personal matter. (IMHO it's basically "vim vs Emacs" type of issue.)
