The thing is, you would have to disallow running as root in the system itself, including suid binaries and other things (e.g. docker exec -u root). User namesp

The thing is, you would have to disallow running as root in the system itself, including suid binaries and other things (e.g. docker exec -u root). User namespaces forces this. It's not just about not running as root, it's making sure the container cannot map to the real UID 0.