rkt can discovery, retrieve, verify, and store images without root privileges.
core@core-02 ~ $ rkt fetch quay.io/coreos/alpine-sh
rkt: searching for app image quay.io/coreos/alpine-sh
rkt: remote fetching from URL "https://quay.io/c1/aci/quay.io/coreos/alpine-sh/latest/aci/linux/amd64/"