peter@grace:/etc/systemd/nspawn$ cat caddy.nspawn
[Exec]
ProcessTwo=on
Parameters=/bin/caddy -agree -email peter@7bits.nl
WorkingDirectory=/srv/www
Capability=CAP_NET_BIND_SERVICE

[Files]
BindReadOnly=/srv/www
BindReadOnly=/etc/ssl/certs

[Network]
VirtualEthernet=no
#Port=80
#Port=443

peter@grace:/etc/systemd/nspawn$ sudo systemctl stop systemd-nspawn@caddy.service
peter@grace:/etc/systemd/nspawn$ sudo systemctl start systemd-nspawn@caddy.service
peter@grace:/etc/systemd/nspawn$ sudo systemctl status systemd-nspawn@caddy.service
● systemd-nspawn@caddy.service - Container caddy
   Loaded: loaded (/lib/systemd/system/systemd-nspawn@.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2019-03-04 19:51:17 UTC; 3s ago
     Docs: man:systemd-nspawn(1)
  Process: 27929 ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-veth -U -
 Main PID: 27929 (code=exited, status=1/FAILURE)
   Status: "Terminating..."
      CPU: 68ms

Mar 04 19:51:17 grace.7bits.nl systemd[1]: Starting Container caddy...
Mar 04 19:51:17 grace.7bits.nl systemd-nspawn[27929]: Selected user namespace base 1389494272 and range 65536.
Mar 04 19:51:17 grace.7bits.nl systemd-nspawn[27929]: Timezone Etc/UTC does not exist in container, not updating container
Mar 04 19:51:17 grace.7bits.nl systemd[1]: Started Container caddy.
Mar 04 19:51:17 grace.7bits.nl systemd-nspawn[27929]: Activating privacy features... done.
Mar 04 19:51:17 grace.7bits.nl systemd-nspawn[27929]: 2019/03/04 19:51:17 Listen: listen tcp :80: bind: permission denied
Mar 04 19:51:17 grace.7bits.nl systemd[1]: systemd-nspawn@caddy.service: Main process exited, code=exited, status=1/FAILUR
Mar 04 19:51:17 grace.7bits.nl systemd[1]: systemd-nspawn@caddy.service: Unit entered failed state.
Mar 04 19:51:17 grace.7bits.nl systemd[1]: systemd-nspawn@caddy.service: Failed with result 'exit-code'.