[stickynotememo]

And why not Docker? I feel reluctant to suggest it even though you explicitly declined it, but it really does seem to be the best solution.

[buchanae]

I initially reached for Docker actually, but when I started researching how to run it securely, I just thought "I don't need this. Systemd is already there and does all of this in an easier and more direct way".