I'd prefer regular Debian packaging plus containerisation via systemd-nspawn or just the various systemd security features that use the same Linux namespacing features as Docker.

http://0pointer.net/public/systemd-nluug-2014.pdf http://ftp.nluug.nl/video/nluug/2014-11-20_nj14/zaal-2/5_Len...