Comment by ethersteeds

Full virtualization. Docker implies a shared kernel attack surface, that's what you want to avoid.