Docker-in-Docker in CI Without Handing Jobs Root
ephemerd runs Docker-in-Docker for container: jobs without a privileged container. Here is what a job could still reach, and the four PRs that closed each hole.
ephemerd runs a fresh GitHub Actions runner per job. Some of those
jobs need Docker. A workflow builds an image, runs a service container, or uses the container: key. The usual way to
give a self-hosted job Docker is Docker-in-Docker, or dind.
