That sounds entirely reasonable. Based on the ensuing discussion, it sounds like - You don't secure the container, you secure the system running the container.

That sounds entirely reasonable. Based on the ensuing discussion, it sounds like - You don't secure the container, you secure the system running the container. When you hand me a container to run, maybe I run it in a secured VM. Or maybe I run it inside a secured container; or I [get further out of my depth and] secure the Docker process itself. From the perspective of the person writing the code running in the image, I just need to secure my application code - such as standard SQL injection, proper management of configuration keys, etc - but I don't really worry about securing the system running my container from my container. ...Although I guess that raises the question: how much do I need to secure my container from the system it's running on - or is that such a breach of trust it's pointless?