Many of these points are about running pipelines in privileged containers. Something I actually took extra time to resolve for my team. That's when I discovered

Many of these points are about running pipelines in privileged containers. Something I actually took extra time to resolve for my team. That's when I discovered kaniko first, and shortly after podman/buildah. After that podman and buildah have gotten a lot of great reviews from people so I think they're awesome. For an old time Unix sysadmin it just doesn't make sense to run something as root unless you absolutely have to. Which also makes the client excuse in the article so strange, they had to run the container privileged to run static code analysis. wtf. Doesn't that just mean they run a tool against a binary artefact from a previous job? I fail to see how that requires privileges.