We hit security concerns here in two directions: -- When our sw gets deployed on-prem by our users (or in their cloud, or wherever), our customers rather not d

We hit security concerns here in two directions: -- When our sw gets deployed on-prem by our users (or in their cloud, or wherever), our customers rather not deploy our SW with root for no good reason. Some of them have to do things like fill out forms ahead of time or on use due to this (!). -- In turn, when we run third-party code, say as a normal dependency or a user-submitted script, we have no reason to trust it. That means we want to limit what it can do, and especially if something breaks out, have defensive layers. (Browsers & NodeJS are Technology From The Future in this regards.) Note that almost all "docker exploit X FUD" articles, in fine print, make assumptions around running docker as root / privileged / etc. It's 2019, we know better. Also, we happen to run an increasing amount of our stack as GPU code, which adds a (not so) funny layer to all this.