In terms of mitigation, simply running as non-root is not enough as it is very difficult to prevent escalation to root (e.g. suid binaries). User namespaces wh

In terms of mitigation, simply running as non-root is not enough as it is very difficult to prevent escalation to root (e.g. suid binaries). User namespaces which is setup such that uid's in the container are not mapped to any in-use uids on the host is needed.