By default: yes. Recently docker introduced a --userns-remap flag for the daemon which allows interested users to define a user that "root" in containers shoul

By default: yes. Recently docker introduced a --userns-remap flag for the daemon which allows interested users to define a user that "root" in containers should be mapped to. And it will also create one automatically if the flag is invoked without specifying one explicitly. It's not on by default because of backwards compatibility issues. For one thing, bind mounts as most users rely on them today would likely break completely. But the option is there.