<i>&gt; Docker containers do not need to run as root and the documentation does recommend running containers as non-root users. Yet, unless something is default, it&#x27;s hard to make users follow best practices. For that reason, user namespaces are important.</i><p>Definitely, but, in my experience, it gets worse than that, and why this is <i>really important</i> and not just important. Most containers are built on top of full OS images, with a full OS image&#x27;s worth of vulnerabilities (some inert because services aren&#x27;t running, but setuid&#x27;s still respected--and I wonder how many setuid&#x27;d tools are actively tested in a containerized environment!), and it&#x27;s rare in my experience that those base containers actually get updated after the end user selects one and a version to go along with it. Which means that even a properly-built container that doesn&#x27;t run its internals as a non-root user may--and a pessimist might say &quot;probably does&quot;--have user escalation bugs squirreled away somewhere that the user not only doesn&#x27;t know about, but isn&#x27;t capable of auditing or is even aware that they <i>might</i> exist.<p>This, not &quot;users don&#x27;t read docs&quot;, is why I am so very, very salty about this in Docker, and while I&#x27;m glad that now Docker users (and, full disclosure, I&#x27;m not one anymore in part because of the poor security story--monolithic do-everything daemon running as root, no user namespaces--and in part just not wanting to be the stooge for somebody&#x27;s platform play) don&#x27;t have to &quot;expect to wait long&quot;, this was promised in something like Docker 1.4, a year ago.