@wolf480pl @quad I've never used systemd other than fixing broken debian installs, so I can't say but I don't thing it comes any close to bwrap.
Like can you isolate /dev, /sys, /proc with systemd? Or get a tmpfs (which is specially neat for throwaway containers).