rkt actually uses systemd-nspawn to run and namespace the container. What rkt "adds" before that is downloading, verifying managing the container image and setting up the cgroup for resource limitation.

https://github.com/coreos/rkt/blob/master/Documentation/deve...