[dln_eintr]

rkt actually uses systemd-nspawn to run and namespace the container. What rkt "adds" before that is downloading, verifying managing the container image and setting up the cgroup for resource limitation.

https://github.com/coreos/rkt/blob/master/Documentation/deve...

[masterleep]

Doesn't systemd do that already (via machinectl, e.g.)?