That's not true, those capabilities can be granted to normal users. If the container is badly composed enough, sys admins might grant a user those caps so they

That's not true, those capabilities can be granted to normal users. If the container is badly composed enough, sys admins might grant a user those caps so they can avoid security alerts about running containers as root.