Because giving your app root even to the container could let it blow something up that’s important inside the container, and it means you don’t necessarily know

Because giving your app root even to the container could let it blow something up that’s important inside the container, and it means you don’t necessarily know what permissions it actually requires. Then when you get to a client site and they say “Docker isn’t on our approved software list” you won’t know what permissions it needs to install. There’s a low chance of this scenario happening, but lord knows there’s a Unix greybeard somewhere that doesn’t want Docker on his precious pets, and will like to know what permissions your app actually needs.