This is stated in the man page for systemd-nspawnNote that even though these security precautions are taken  systemd-nspawn is not suitable for secure container setups. Many of  the security features may be circumvented and are hence primarily  useful to avoid accidental changes to the host system from the  container. The intended use of this program is debugging and testing  as well as building of packages, distributions and software involved  with boot and systems management.This very question was subsequently asked on the mailing list in 2011, but the answer seems to be outdated.systemd-nspawn contains code to execute CLONE_NEWNET using the --private-network option now.  This seems to cover the private AF_UNIX namespace issue, and I guess the CAP_NET_RAW and CAP_NET_BIND issues mentioned.What issues remain at this point and what does for example LXC do in addition to what systemd-nspawn can currently do?
What makes systemd-nspawn still unsuitable for secure container setups?
security;systemd;lxc
LXC is a little bit better because it can run containers as unpriveleged users. This is possible with systemd-nspawn, but only for scenarios where you only need one user (instead of multiple), which can be difficult or less secure for multi process in container scenarios. If you want to know why docker, lxc, and systemd-nspawn are inherently not a solid security mechanism, read this: https://opensource.com/business/14/7/docker-security-selinux. Basically, containers still have access to the kernel and any kernel exploit gains control of the entire machine. On a monolithic kernel like Linux, kernel exploits are not uncommon.