When it comes to containers, it unfortunately has become common practice to run services with way more privileges than necessary (if not directly as root).
Docker remains the dominant player in this field but there is a new underdog and I think it’s better suited for most of the cases:
Podman (short for pod manager) is a modern systemd-based substitute for Docker that already comes pre-installed with many operating systems – and it’s rootless by design.
Podman Quadlet is the analogue of Docker Compose – currently the de facto standard for deploying multi-container applications.
In the following, I describe my way to set up a Nextcloud instance using Podman Quadlets that runs exclusively with user privileges.