Systemd is a bit of a joke in some areas: binary logs for instance. So praising systemd at all often invokes scorn. That being said, ‘containing stuff’ is one a

Systemd is a bit of a joke in some areas: binary logs for instance. So praising systemd at all often invokes scorn. That being said, ‘containing stuff’ is one area it actually does really well. Two other excellent comments have covered the meat and potatoes of it, so I will just add a few things because they are spot on. What does right is it allows you to very specifically set ports allowed, cpu/mem limits, filesystem access limits, read-only paths, read/write Paths, chroot, private devices, private network, and many more for any single generic program: you can contain anything. We add authbind to the mix to allow for binding to lower ports. All of the spawned processes are visible from the host system using regular normal unix tools. What does even better than Docker is _not_ downloading third party code/programs from a repository. This is a much smaller footprint and allows for much easier inspection. You _can_ if you want, use systemd-nspawn which will give you a completely private deb-bootstrap, sorta mirroring what Docker does, but in my opinion that’s not necessary and increases the amount of things you need to update.