Docker compose makes it relatively easy to coordinate multiple containers. But to answer your actual question, yes, that’s possible though definitely not recommended for standard hosting, it’s called DiD (docker in docker) and is fairly common for CIs.

It is common to use --privileged (or -v docker.sock) and run docker commands inside docker. But then you're not really in the container, you may as well be on the host.

I think genuinely containerizing inside an ordinary container, without --privileged, would mean taking extreme compromises like bocker or proot.

What's the state of the art here?

I cannot fix my comment anymore, but I meant to write DinD.

See https://hub.docker.com/_/docker

The Nextcloud All in One (AOI) images takes another approach, which is use the first image to launch the other needed images. So it lets you avoid docker compose at the cost of needing to pass the docker socket to the AOI container.

I tried this and I did not enjoy it. A docker container with access to docker socket is so cursed.

I kept having issues, like I tried to stop the container and it left all the extra containers it made running. They also had different network settings than the ones I set on the parent container. I don’t remember the exact issue but I had to manually adjust the network that it made- because it just made its own and ignored the one I assigned the parent container too.

It was the easiest way to get Nextcloud running but I immediately stopped it. I don’t want Nextcloud able to tamper with my other docker containers. I want it contained.

I haven’t yet had a chance to figure out how to get their containers running normally.