It is common to use --privileged (or -v docker.sock) and run docker commands inside docker. But then you're not really in the container, you may as well be on the host.

I think genuinely containerizing inside an ordinary container, without --privileged, would mean taking extreme compromises like bocker or proot.

What's the state of the art here?