So what? You're still root. You're relying on a sandbox to plug a few voids while you still effectively held keys to the kingdom before said voids were plugged.

So what? You're still root. You're relying on a sandbox to plug a few voids while you still effectively held keys to the kingdom before said voids were plugged. I hear this excuse daily from developers who insist on running all their docker containers as root "because we have to". If you're relying on a sandbox as your first line of defense you've already lost the war.