&gt; &gt; Something about running as root iirc?<p>&gt; The daemon runs as root, so your containers are only as secure as the daemon itself.<p>This is not correct. The daemon only starts and monitors processes in this case. You can start a process as a different user. You can also use user namespaces to make &quot;root in the container&quot; not root on the host.