machinectl runner

[erikh]

machinectl is a fairly recent addition to the container/VM ecosystem which allows running VMs with qemu and containers through systemd-nspawn.

I think this is the future if we can work out how to use docker images with it. It has better capabilities for restricting the network and overall security of the process execution environment, as well as setting reasonable constraints for use.