Except root is that account. You're still crossing a user-boundary same as Windows. If you give your user CAP_SYS_ADMIN that's like putting them in the Administ

Except root is that account. You're still crossing a user-boundary same as Windows. If you give your user CAP_SYS_ADMIN that's like putting them in the Administrators group.