Subuser doesn&#x27;t work around this issue. As a USER you can become root using docker. However, that doesn&#x27;t mean that your SUBusers can become root. And that&#x27;s what you are trying to protect your system from. The &quot;less trusted&quot; code that is running in the subusers.