Except container permissions in practice are non-existent. They have essentially all the permissions by default. There is a reason you have to run your contain

Except container permissions in practice are non-existent. They have essentially all the permissions by default. There is a reason you have to run your containers as NON ROOT. It's because containers can leak root access(last I checked, though I doubt it's changed any).