To pose an alternative scenario: > A novice sysadmin granting someone's request to [be able to run some tool/software that says it needs this, but is in fact s

To pose an alternative scenario: > A novice sysadmin granting someone's request to [be able to run some tool/software that says it needs this, but is in fact secretly malicious] or perhaps more common > A novice sysadmin granting someone's request to [be able to run some legitimate tool or software, then later a virus in the container taking advantage and breaking out] for a real world example, the Nvidia Nsight docs specifically direct you to add SYS_ADMIN; do you think your everyday ML engineer would know that doing so poses a security risk if they're doing this on Docker?