This is useful for things we may not want or be able to run when operating in a docker container.

Specific example is systemd-timesyncd, which refuses to start in a container:

```
[Unit]
Description=Network Time Synchronization
Documentation=man:systemd-timesyncd.service(8)
ConditionCapability=CAP_SYS_TIME
ConditionVirtualization=!container
DefaultDependencies=no
...
```

Note the `ConditionVirtualization` blocking.

Useful state might be something like:

```
systemd-timesyncd:
  pkg:
    - installed
  service:
    - enable: True
    {% if grains["detect_virt"] not in ["docker"] %}
    - running
    {% endif %}
```

Which would _enable_ the service but not fail when it fails to start.