I actually use systemd, not systemd-nspawn (it's also in the README), because using both does not always play together.

As far as systemd vs dockerd goes, dockerd provides a bit more isolation by default, but `systemd-analyze security` can guide you so far beyond the Docker defaults. And it is always compatible with system daemons, giving consistent configuration between, say, postgresql from package manager and prometheus from docker container+undocker.