You kind of missed the key to the whole thing here, though, which is that users are able to create userns' now by default. This is really important to understan

You kind of missed the key to the whole thing here, though, which is that users are able to create userns' now by default. This is really important to understanding this and the last few container escape CVEs. The article doesn't do much better on that front, but it is in there at least.