> Maybe throwing docker into the mix makes it clunkier, though? Correct. It increases the attack surface without adding benefits over light containers like sys

> Maybe throwing docker into the mix makes it clunkier, though? Correct. It increases the attack surface without adding benefits over light containers like systemd-nspawn or just systemd unit files.