> In the last leg of your journey to avoid building a Kubernetes, your manager tells you that your app needs to programmatically spawn other containers. Spawning containers, of course, requires you to mount the Docker socket in your web app, which is wildly insecure.

This was true ten years ago, it's not been true for at least 2-3 years.

You can run rootless podman in kubernetes (I did) and you can launch pods from there. Securely.