Docker
CT or VM as your Docker host?
The VM clearly wins in terms of flexibility and security. The KVM VM is much better isolated from the host than the CT, can have full root rights, use features such as GPU pass-through and supports live migration.