> > Where is Docker not running a daemon as root? > Docker runs unprivileged by default, but only on relatively recent kernels with user namespace support (it

> > Where is Docker not running a daemon as root? > Docker runs unprivileged by default, but only on relatively recent kernels with user namespace support (it drops itself to "fake root" so it can still create containers without actually having uid0). Is that right? As far as I'm aware, runC doesn't have support for anything like that (and Linux's method of handling network namespaces under an unprivileged user namespace doesn't allow you to even have a network connection to the outside world). Sure, in runC we're working on rootless containers, but that's a while away from being done and Docker might not ever be able to support rootless containers completely (since it needs to handle networking and some other things that still need some quite significant kernel work to complete).