[remram]

Yeah and installing it as a systemd service, which uses basically as much namespacing/cgroup/supervision/mounts as any other container runtime.