yis, systemd-nspawn, still the goat. one main advantage i think is running long running containers, that have a full systemd running inside them (multiprocess). docker is horrible at multiprocess. and with that type of thing, you can have agents running inside that handle incremental updates and things are just easier this way vs trying to go 100% single process. having a single process is not a requirement for microservices and it eats into the uptime having to be a single proc wrangler. haproxy is a good example, it has really, really good hot-reloading. and docker won't let it do that. it's just cgroups, and volumes are bind mounts for your persistent data. fast. very.