It&#x27;s not the <i>worst</i> thing in the world, because a competent administrator&#x2F;infrastructure engineer who&#x27;s comfortable with the underlying tools can account for this and mitigate it. That said, Docker markets consciously and directly to people who are not competent, with an undercurrent of &quot;you don&#x27;t <i>need</i> competent people to use this!&quot;. And, as in most computer-y cases, it&#x27;s not the fault of the incompetent and the ignorant that they trust the providers of tools; implicit in actually providing them is that they are generally safe with the defaults that are given. Which in Docker&#x27;s case they&#x27;re emphatically not. That hurts people, and very little gets me saltier than hurting people unnecessarily.<p>(I haven&#x27;t ruled out that it might be a lack of a culture of security, too, on the Docker team&#x27;s part; there was that whole &quot;oh, yeah, put desktop applications in Docker containers, never mind that now you&#x27;re <i>running Chrome as root</i> and <i>putting the unprivileged X socket in the container, letting it pump messages to any other application</i>&quot; thing from a Docker core contributor. Maybe they just don&#x27;t know, themselves? Woof.)