Hacker News Reader

Running as root within a container means your still running as root on the host as well for the underlying process. If there's a security issue with containerization, you'll end up with root on the host.

Running as a non-root user in the container is an extra level of protection and follows the principle of least privilege.

(Author here.) So far as I can tell, it's not that there are known, specific things that one can do to break out of a docker container as root; it's just that the space of possible things you can do is larger, so there is more surface area for you to attack. So, following the principle of least privilege [1], you should avoid running as root, if you reasonably can, and in most cases it's not that hard to do.

[1] https://en.wikipedia.org/wiki/Principle_of_least_privilege

Docker is very clear about this in their documentation: Don't run applications as root.