> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. False. > And how is SELinux a good security module? It's good

> systemd-nspawn isn't a container. For example it doesn't manage resources such as CPU or IO. False. > And how is SELinux a good security module? It's good enough for most environments requiring RBAC. Additionally, it's complemented by the excellent sandboxing ability of SystemD unit files.