Docker-ce from upstream docker works well on Debian.

I've not looked at "naked" lxc for quite some time - but I've used Lxd on Ubuntu a bit, and that's a great experience.

If what you want is "containers" (single-purpose, ephemeral) - I'd say for now the docker tooling is best. But there's not much isolation - there lxc is better.

I've yet to try alternative "run times" like rkt - but I believe that's the better way forward compared to docker. For now we use docker mostly for packing up an application and managing dependencies - not for resource/security isolation.

I suggest reading over :

https://coreos.com/rkt/docs/latest/rkt-vs-other-projects.htm...