Devcontainers vs systemd-run: Consistency vs Containment

DX: devcontainers win outright — you get a reproducible toolchain, editor integration (VS Code/Gitpod), and devcontainer.json as the single source of truth. systemd-run is raw: you're hand-writing unit files with ProtectHome=, PrivateTmp=, ReadWritePaths= etc. every time, no editor awareness, no "just works" on a fresh laptop.

Security: systemd-run has the edge for tight isolation — namespace + cgroup + seccomp per-process, no daemon in the blast radius, and you can drop capabilities surgically. Devcontainers still run under Docker/Podman, so you inherit the whole containerd + runc attack surface and the default bridge network unless you go out of your way. For an AI agent or untrusted code, systemd-run (or a microVM) is the safer cage; for "my dev env matches CI", devcontainers are the pragmatic pick.

The real tradeoff: devcontainers optimise for consistency across humans and machines; systemd-run optimises for containment of a single process. They're not really competitors — people usually want both (devcontainer as the shell, systemd-run to jail the risky bits inside it).