It is common to use --privileged (or -v docker.sock) and run docker commands inside docker. But then you're not really in the container, you may as well be on t

It is common to use --privileged (or -v docker.sock) and run docker commands inside docker. But then you're not really in the container, you may as well be on the host. I think genuinely containerizing inside an ordinary container, without --privileged, would mean taking extreme compromises like bocker or proot. What's the state of the art here?