> Perhaps they’re passing this command to a secured container? This would still raise my eyebrows, since root inside a container is still something you should

> Perhaps they’re passing this command to a secured container? This would still raise my eyebrows, since root inside a container is still something you should avoid unless absolutely necessary (especially if they aren't using user namespaces). Just because containers add some newer security features to regular processes doesn't mean you should forget the security features (POSIX DAC) that were there in the first place.