Q: Your security team mandates that Docker must run without root privileges on all developer workstations. The developers still need full Docker build and run capabilities. How do you achieve this?

Use Rootless Docker, which runs the Docker daemon and all containers entirely within a user's namespace without requiring root privileges on the host. Installation: dockerd-rootless-setuptool.sh install (ships with Docker 20.10+). The daemon runs as the user's systemd service, stores data under ~/.local/share/docker/, and maps UIDs using newuidmap/newgidmap (requires /etc/subuid and /etc/subgid entries). *Limitations:* Cannot bind to privileged ports (<1024) without CAP_NET_BIND_SERVICE. --net=host doesn't work. Overlay networks require kernel 5.11+ with unprivileged overlay support. Some storage drivers may have reduced performance. Despite these trade-offs, rootless Docker satisfies the security mandate while preserving standard build and run workflows.