Install docker (systemd daemon) in a separate rootless Linux namespace (user). I wrote this down here [1]. Zero trust & separation of concerns.

[1]: https://du.nkel.dev/blog/2023-12-12_mastodon-docker-rootless...