"these “system” containers should be able to run containers inside them as well (docker in docker?)." I think you can run podman in podman. But your comment

"these “system” containers should be able to run containers inside them as well (docker in docker?)." I think you can run podman in podman. But your comment actually makes me wonder how easy it would be to run docker/podman in chroot