systemd-nspawn is worth a look - I found it more intuitive, well designed and security conscious (within reason for containers) than the other container options

systemd-nspawn is worth a look - I found it more intuitive, well designed and security conscious (within reason for containers) than the other container options. It must get some serious use behind closed doors somewhere, because the quality outstrips the amount of publicity it gets