Docker is by far the easiest. And you can create a new user for each service and run the daemon under that user if you are worried about vulnerabilities in docker itself