> It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase. My understanding of Docker has always been that you're not s

> It always felt like "Buy our kevlar vest, but maybe pack some chainmail underneath. Just incase. My understanding of Docker has always been that you're not supposed to rely on it for security—it's less a kevlar vest and more a build-your-own-platemail tinker toy set. If you know what you're doing you can create a quite secure environment with it, but if you don't you're not that much better off than running stuff directly on an EC2 instance. Some practices that help secure your image are running a stripped-down image (fewer binaries to call out to if an attacker achieves RCE) and being judicious in volumes and network settings. But yeah, I'd definitely also prefer to see the container running rootless. It's all about reducing what an attacker can do if they get to RCE, and root still plays a role in that.