> opens privileged ports inside the container that get mapped to unprivileged ports on the host
You can either allow those ports to be mapped on your host, or you can map a higher port on the host 8000:80 or 4443:443. I did the former.
The biggest problem I have with docker other than root is that it touches the firewall for convenience. Any port you map on the host will be opened in nftables, as per the documentation[1]. Very dangerous default that few developers realize is a problem. You probably only want 80/443 open and proxy your subdomains on the host, but all ports are now exposed to the internet.