I believe that &quot;root is root&quot; is just shorthand for...<p>If you aren&#x27;t using unprivileged containers, then the only approach you have for making the container more secure than chroot is a whack-a-mole style approach.<p>By whack-a-mole, I mean trying to map out the attack surface, and using a hodge podge of tools to try and close them (kernel cap-drops, apparmor, se-linux, firewall rules, overlay mounts for &#x2F;proc, &#x2F;sys, etc).<p>I think it&#x27;s reasonable to say that the whack-a-mole approach isn&#x27;t truly more secure.  In the same way that having a vault door on the front of your house, next to an open window isn&#x27;t any more secure than having the door wide open.