And on top of that: real seccomp sandboxes, dynamic users, chroot, isolated mounts, read-only mounts, isolated groups, process isolation, network isolation, vir

And on top of that: real seccomp sandboxes, dynamic users, chroot, isolated mounts, read-only mounts, isolated groups, process isolation, network isolation, virtual interfaces, virtual /proc and /dev mounts, capability boundaries etc etc ...all that stuff that is real painful to implement with OpenRC or other init script environments. Out of the box, and can be used with every single systemd unit file. Isn't that amazing?