> Can't the issue be avoided by simply launching the application as a non-root user within the container namespace? Yes, though the issue currently is that wit

> Can't the issue be avoided by simply launching the application as a non-root user within the container namespace? Yes, though the issue currently is that with the likes of (rootfull) docker containers, users end up setting docker to not need to call sudo every time. Meaning, if an attacker accesses your workstation (or a server), they will be able to run docker containers as root. This may as well be giving the attacker access to root as you can really easily give yourself full root access if you can launch rootfull containers. Having (rootfull) docker run access is pretty much the same as having root access.