I think the fishiness is exactly what your intuition is pointing to: root is easy, "proper" is not. There are very few applications where you need true root at

I think the fishiness is exactly what your intuition is pointing to: root is easy, "proper" is not. There are very few applications where you need true root at runtime, and most can get by with correctly configured user space. The issue is complexity and lack of appropriate abstractions. The "Let's Encrypt" of dockerfile safety would be something that makes it trivial to 1) create a user 2) chmod/chown an appropriate spot on the fs, 3) ideally let the author defer these actions to always finalize the image in user mode. That way, you declare at the top that you will do these user actions, but RUN stays as root. Or just provide an SRUN, SCOPY,SADD directive which acts like running with sudo. Then, you can easily extend a layer or base image without being concerned with the details of how user space is implemented. Also there is no standard or idiomatic protocol for setting up user space in a dockerfile.