I also note they could run head on /etc/shadow without sudo > docker run -it alpine:3.$i head -n 1 /etc/shadow The container process itself is running as the

I also note they could run head on /etc/shadow without sudo > docker run -it alpine:3.$i head -n 1 /etc/shadow The container process itself is running as the locally namespaced root account anyway. From my possibly incorrect interpretation... unless you are trying to build containers like VMs with multiple users and init etc, this null root password issue seems irrelevant.