It's the same user, but with locked down access (by default). As an example, can't ptrace by default. A container is a process with some kernel isolation mecha

It's the same user, but with locked down access (by default). As an example, can't ptrace by default. A container is a process with some kernel isolation mechanisms setup around it. Unless one of those mechanisms is a user namespace with uids/gids mapped to an unused set of users, you get the same user.