How to secure a docker host to not allow rooting

I am trying to make docker on a server more secure. The main problem is that most people say "if a person has access to docker, they can be root too" for an administrator point of few this is not something you would want.

To elaborate, they can use -v and mount /etc onto /mnt in the container and change the shadow file and gain access to the host. They can use -d, or privileged option to do more too.

So basically, there are a few things that i want to "try" and restrict.

1. Volume bind mounts
2. Privileged
3. --add-cap
4. -d (certain items?)

My ideas so far:

• Alias to a bash script for docker, use sudo on it and regex all that they should not do.
• Turn on remote api, secure it and perhaps reverse proxy it with nginx and regex in nginx the things they should not do.
• Use other tools? Mesos/Marathon/Swarm/Shipyard/Whatever

Optional items would be to make containers on commit to git code, and let a "checker" verify the contents of the Dockerfile and create the image for them. Then sign that image and deploy it automatically. (but this would not give them much freedom anymore)

Also, removing the bind volume is not the nicest. Would be much simpler if we had a plugin for docker that says "you can only mount on /data, as user X" where the USER in the Dockerfile is that user X.

Something like docker-novolume-plugin is already a nice start for the volumes, doesn't restrict bind volumes though.

In the end the question would be, how can i let users build/pull/run docker images as their own user/docker and not be able to root the system. Doesn't have to be perfect as long as it works.