Original question: How to allow the user to spin new containers of his own and not access the other containers?
(This was my answer originally but perhaps I misunderstood the question or the question was not so clear, I kept the original solution here anyway)
Docker does not provide this feature on its own but there are multiple ways to do this.
The idea is that docker commands require either the user to be in sudo or docker group to run, so if you only want the user to spin a new container, instead of adding the user to sudo or docker group which provides full access to all docker commands, you can whitelist only several docker commands for that user.
For example if you want to allow user tom to run the following container:
sudo docker container run --it --name ubuntu-tom ubuntu:latest bash
You may add the following line to your sudoers file by running sudo visudo:
tom ALL=NOPASSWD: /usr/bin/docker container run --it --name ubuntu-tom ubuntu:latest bash
This allows user tom to run this particular docker command as root without requiring a password. Any other docker commands remains unavailable to user tom.
Another alternative is to setup restricted shell but I will not go into details here.
Updated question: How to limit the user to manage new containers?
I am not aware of a possible solution using Docker only.
It sounds like you need an orchestrator such as Kubernetes or ECS.
This way the orchestrator owns the docker daemon and you can utilize the permission layer provided by the orchestrator. This article provides a great example of restricting user access to a namespace.