I don't want to run services as root, except for services that grant login rights (It's probably better to have one ssh daemon, than allow/force every user to r

I don't want to run services as root, except for services that grant login rights (It's probably better to have one ssh daemon, than allow/force every user to run their own...). And even then, keep the code that can change user I'd to a minimum. I certainly don't want run big, rapid-changing code as root. Not the countinous integration pipeline, not the build pipeline. It's a misfeature of docker that it needs more privileges than a traditional chroot/fakeroot build (probably a good reason to build on those tools to build docker images, rather than rely on Dockerfile/docker build. Build images and reserve Dockerfiles for pulling in ready images and setting some parameters for configuration).