When should docker be used over NixOS services?

[raboof]

@Tmplt

because of their relative complexity I want these services only to access a bare minimum of system resources. A trivial service can also be a bad actor, but then I might as well dockerize all my services, and that offers up a lot of the convenience of using NixOS

NixOS services, because they are systemd services, also support some isolation features (NixOS policy regarding systemd-confinement, DynamicUser and a whole host of other options), but so far I’ve not found that particularly easy to use