A completely new user:group namespace is created inside the container. This is, in very large part, what Linux namespaces are for. No. root inside is root outs

A completely new user:group namespace is created inside the container. This is, in very large part, what Linux namespaces are for. No. root inside is root outside (if you can get outside). The behavior you describe only applies if you enable user namespace remapping, which docker doesn’t by default.