> Maybe throwing docker into the mix makes it clunkier, though?

Correct. It increases the attack surface without adding benefits over light containers like systemd-nspawn or just systemd unit files.