Comment by mianos

No joke, it's already there, systemd-nspawn can run OCI containers.