> some proprietary software running as root is a bad idea. LXD does not provide security for that case. (unprivileged containers do have some sort of security

> some proprietary software running as root is a bad idea. LXD does not provide security for that case. (unprivileged containers do have some sort of security measure related to this by mapping the uid 0 inside the container to one that is not privileged outside the container. Tools that need root but make no privileged system calls can work inside an unprivileged container. Example: an installation script that wants to call a package manager to install shared libraries as dependencies might require root, but only for filesystem changes inside the container, so that works. Tools that require privileged access to the kernel will not work in unprivileged containers. - this is very simplified - containerization is process isolation and fine tuned privileges can reduce attack surface, but it should not be seen as a "one size fits all" solution for this particular case) > pass X.org, Pulse Audio, Video devices, etc. or that one (this is harder to explain. Basically: X is not designed with security in mind: if you give a keylogger access to your X session it can log your keys. pulse audio means you are doing a deep dive, because if you map the isolated uid to the uid the pulseaudio server, containment is broken. It is possible by assuming the container is "on the network" but nontrivial and lets not talk about microphones or selective access. Finally passing through pcie devices that have direct memory access is the containment equivalent of paying for the bus and asking the process to be home for dinner.)