I second systemd-nspawn being a hidden gem for this usecase. I use git post-recieve hooks that target it for much of my ci/cd pipelines.

I also find myself using nspawn just to isolate apps like firefox, etc.