I avoided looking at docker/runc as a starting point since that would spoil the fun of trying to figure it out from first principles. I looked at systemd-nspawn when I was stuck adding mounts.