What's the trade-off between Docker-in-Docker (DinD) and socket-mounting in CI pipelines?

DinD runs an isolated nested Docker daemon inside the CI job's container, avoiding shared-daemon risk but requiring privileged mode (a security concern) and losing host-level build cache by default. Socket-mounting shares the host's daemon (faster, cache-friendly) but means any container in that CI job has effective root access to the host's entire Docker environment — a bigger blast radius if the job's own dependencies are compromised.