Tag docker

A practical comparison after actually running both - the daemon versus fork-exec model, what rootless containers really protect you from, why systemd integration mattered more than I expected, and the cases where Docker is still the right answer.