I hate that systemd refuses to work in a chroot. With all those extra services in systemd like dns, it's impossible to run in a container or chroot... And the developers blatantly refuse to fix that.
dns, network and ntp services are run in separate processes. These processes are sandboxed in a more effective manner than chroot (namespaces, capabilities, etc.).
Moreover, systemd itself relies heavily on Linux sandboxing tools (like cgroups).
