Though things have improved considerably a while back with docker dropping most capabilities before starting a container, but without user namespacing on a shar

Though things have improved considerably a while back with docker dropping most capabilities before starting a container, but without user namespacing on a shared kernel, ultimately root in the container == root in the host machine. More specifically, uid 0 on the container == uid 0 on the host, so if container breakout occurs then you have root on the host. As you mention, user namespaces and remapping the root user should solve this issue, but initial support for this was only released 7 days ago in docker 1.10.2 > https://github.com/docker/docker/commit/ed9434c5bb64f49db442027e5e748bfbb46d0a0a https://github.com/docker/docker/commit/ed9434c5bb64f49db442... [edit]: Preliminary support for user namespaces was added in 1.10, above commit is addressing a bug in userns support.