Presumably, (1) he wants the software to run as within-container root and (2) since this is work-related, he has a limited degree of trust that it at least won'

Presumably, (1) he wants the software to run as within-container root and (2) since this is work-related, he has a limited degree of trust that it at least won't actively try malicious activity like trying to break out of the container