If you want to set the filesystem as read only in a Docker container you can do that, without needing to set-up multiple users in the container. In general tha

If you want to set the filesystem as read only in a Docker container you can do that, without needing to set-up multiple users in the container. In general that's a good piece of hardening advice, you just need to mount an empty volume for any temp files that are needed by the app. For not running as root, the main benefit (to my view) is that there have been multiple CVEs in container stacks where the issue fully or partially mitigated if the container was running as non UID-0 CVE-2021-30465 was partially mitigated, and CVE-2020-15257 had a requirement of the container running as UID-0. So whilst it's not a panacea, in general not running containers as root is a good layer of defence.