I do a lot of build automation work, and running containers within containers would be super useful for me. That said docker-in-docker doesn't work without run

I do a lot of build automation work, and running containers within containers would be super useful for me. That said docker-in-docker doesn't work without running privileged or forwarding the host port. It's a non-starter for me, there are the obvious security problems, but also practical non-security issues. Forwarding the port causes encapsulation issues, a build job can finish leaving stuff running, can also interfere with other jobs on the system. Using privileged containers isn't an option when using things like ECS fargate.