That sounds like a heavier-weight wrapper over the same system services they're using through systemd today.

It could be useful if updating is a pain point.

In this case, they may also consider Podman, as it has excellent systemd integration[1] including rudimentary container orchestration and the ability to auto-update containers and Kubernetes-style pods installed as systemd units. I've run Pihole under Fedora CoreOS this way for several years without touching a single thing to update the OS or Pihole.

[1] https://docs.podman.io/en/latest/markdown/podman-systemd.uni...

No we don't need / shouldn't use Docker. As jasomill guessed the disk size and memory usage that Docker needs is just unnecessary overhead. These devices have only 8 GiB disk space. systemd provides every single thing that we need; one can obtain equivalent isolation just with a systemd unit file.

If you don't need the layers of Docker and server pull-push, it is just overhead. We just fetch a single cryptographically signed squashfs file and execute the program in it with limited FS and separate namespaces.