Except that the default is for processes inside containers to run as root. So, "by default, quite secure; except this one default that exposes you to some very

Except that the default is for processes inside containers to run as root. So, "by default, quite secure; except this one default that exposes you to some very nasty attacks unless you override it".