I guess one way of doing it would be to have two instances of rootless docker running, one with this project meant to run all containers, and the one exposed to the container being the other docker engine instance for CI/CD jobs.