"Docker does not support user namespaces"[1] so root inside a container == root on the host. Getting security right with user namespaces is hard though[2]. And

"Docker does not support user namespaces"[1] so root inside a container == root on the host. Getting security right with user namespaces is hard though[2]. And as another commenter pointed out, you can't give a user permission to actually start a docker container without also giving them root access to the host. [1] https://docs.docker.com/articles/security/ https://docs.docker.com/articles/security/ [2] http://lwn.net/Articles/626665/ http://lwn.net/Articles/626665/