How to Use Docker in Actions Runner Controller (ARC) Runners Securely

A deep dive into securely running Docker within Actions Runner Controller (ARC) on Kubernetes. Covers three container modes in ascending security order: Docker-in-Docker (dind) which requires privileged mode and is least secure, Rootless dind which reduces risk but still needs privileged mode, and Kubernetes Mode which avoids privileged containers entirely by spinning up separate pods. Explains trade-offs including the inability to use Docker daemon in Kubernetes mode and alternatives like Kaniko and Buildah for image building. Highlights risks of privileged Kubernetes containers being exploited by malicious dependencies in CI/CD pipelines.