On top of that, you usually want to isolate the container workload with an observable network abstraction instead of granting it full (albeit non-root) access t

On top of that, you usually want to isolate the container workload with an observable network abstraction instead of granting it full (albeit non-root) access to host network facilities (including sockets). See https://medium.com/nttlabs/dont-use-host-network-namespace-f548aeeef575 https://medium.com/nttlabs/dont-use-host-network-namespace-f... for just an example of what can go wrong otherwise.