Nspawn would be perfect if it exposed the full suite of service file security and resource control features. Due to their absence, I've been exploding container

Nspawn would be perfect if it exposed the full suite of service file security and resource control features. Due to their absence, I've been exploding containers into directories and writing my own service units to manage the pseudocontainers.