It isolates just "one application" inside "one domain". What I am looking, is lightweight OS with systemd, network stack, etc, docker and other service running inside.