How can I enable container usage in a sandboxed development environment?

I'm using bubblewrap sandboxes to run my development environment -- everything from IDE to building to running tests.

Integration tests require running containers. What would be a reasonably secure way of providing this, whilst not loosening up the sandboxing? We could always --bind /run/user/1000/podman/podman.sock (or docker socket), but that's a sandbox escape.

Is Docker-in-Docker DIND or the Podman equivalent, the only option, or are there other alternatives?