that's my point. why from a point users didn't have access to netfiltet now gives users access to netfilter? from a command which should be adding more restrain

that's my point. why from a point users didn't have access to netfiltet now gives users access to netfilter? from a command which should be adding more restraint no less. also people focus on this only being a problem now with priv escalation... but all that was always a problem before unprivileged containers... by allowing container code to exploit host kernel code, but nobody called it a privilege escalation then because you started your container as root. sigh.