What value does adding a user add if you're already running a VM? By default, all that user adds is directory-access-controls. Docker provides isolation between

What value does adding a user add if you're already running a VM? By default, all that user adds is directory-access-controls. Docker provides isolation between processes on the system it is running. Executing a root exploit from inside a Docker container is not impossible, but it's also harder than "simply" being a user. Application-level security can also be improved significantly if an application requires multiple processes to run on a host. Docker can be used to restrict processes from accessing the network, etc. Nothing that couldn't be done without Docker by a sufficiently dedicated ops team, I'll admit, but Docker greatly simplifies and standardizes these mechanisms. That's especially true if you've adopted DevOps culture where developers have come to own more of the systems security.