Recent versions of systemd-nspawn can directly download a docker image and run it in a service unit.