I just hope they check for certificates better than Docker does.

systemd-nspawn is a really fun thing to work with for developing early-init/daemons of various kinds, and this adds a bit more tools to that.