[1] http://0pointer.de/blog/projects/socket-activated-containers...
[2] https://developer.atlassian.com/blog/2015/03/docker-systemd-...
Obviously this is tightly locked down with cgroups.