What is the difference between running as non-root inside a container and using rootless Docker?

Setting USER in a Dockerfile makes the containerized process run as a non-root UID inside the container's own view, which is good practice but doesn't change how the Docker daemon itself runs on the host. Rootless Docker runs the entire Docker daemon as an unprivileged user, so there is no root daemon process on the host at all — a more thorough mitigation, since it removes daemon-level root risk, not just in-container process risk.