Run docker containers as untrusted local users, allowing users to run containers (only) under their current UID.
Users cannot configure volume mounts, enable privileged operations, or do other "unsafe" things with Docker. They cannot explicitly pull images, save images, or do anything else that may be unsafe. For safety purposes, all privileged capabilities are disabled, including NET_RAW and SETUID. Users should not expect to be able to use ICMP ping or setuid binaries from their images.
On the same host as a running Docker daemon:
$ udocker image [args...]
This depends the binary being installed as setgid 'docker', allowing access to the Docker socket.
$ go build udocker.go
$ chgrp docker udocker
$ chmod g+s udocker
$ mv udocker /usr/local/bin
$ id
uid=1000(eric) gid=1000(eric)
groups=1000(eric)
$ udocker busybox id
iduid=1000(default) gid=1000(default)
$ udocker busybox echo "hello world"
hello world