nspawn 3.x serves a Docker socket on the host, and it hands out root
nspawn 3.0.0 puts a Docker Engine API on the host at /run/nspawn/api.sock, so tools that speak Docker can manage systemd-nspawn machines, and 3.2.1 adds arm64 packages marked experimental. The socket ships off and takes two commands to enable, an optional drop-in answers on /run/docker.sock, and the project warns that any user with org.nspawn.manage is root on the host.