Docker and the OCI container ecosystem

I think it might even be able to deal with OCI images. In this scheme all the configuration of what to start (and of cgroups) is done in the normal systemd unit files, but the files are contained in some fs image, and that fs image is also set up with all the needed dependencies and such.

The portable service basically just handles the filesystem bits of containers, the rest is handled by existing systemd mechanisms (systemd already manages cgroups for you, and can create user namespaces and such as well).