> basically every app should run in a docker container

Why does it have to be "Docker"? Any other container framework should do as well, no?

Note that systemd can create cgroups and namespaces for processes it manages: http://0pointer.de/blog/projects/security.html