other than what others have said: there's rootless docker too, e.g. as virtualisation.docker.rootless under NixOS. It doesn't have to be this way.