docker-in-docker: run the daemon rootless

[Hansehart]

Run the docker-in-docker daemon as the remote user so the surrounding container can drop --privileged, which today grants the docker group the host's block devices.