Docker runs container as the user you tell it to. Same with nspawn. There's not much difference there in that respect. Nspawn does seccomp-based filtering, sim

Docker runs container as the user you tell it to. Same with nspawn. There's not much difference there in that respect. Nspawn does seccomp-based filtering, similar to the usual systemd services.