> Something about running as root iirc?
The daemon runs as root, so your containers are only as secure as the daemon itself.
The daemon runs as root, so your containers are only as secure as the daemon itself.
> The daemon runs as root, so your containers are only as secure as the daemon itself.
This is not correct. The daemon only starts and monitors processes in this case. You can start a process as a different user. You can also use user namespaces to make "root in the container" not root on the host.