Wow I must be quite behind on systemd indeed. It's been a few years. Is there any isolation offered like you would get with docker or is that a tradeoff?

Edit: looking at the docs is that system-nspawn that's actually doing the heavy lifting. For Linux namespaces. I feel like this has great potential!