FYI, apart from the kernel, OVH's "Ubuntu" image also adds their SSH key to the root user (http://help.ovh.co.uk/InstallOvhKey) and pre-installs some monitoring daemon.
I am also running Docker on one of them just fine.
It's because 90% of users don't know what they're doing and at some point will ask for support, and they probably won't be able to get the techs access when needed. It sucks for the 10% who are capable and willing to operate their servers independently.
Source: I've worked at hosting companies.
OVH does not install any SSH keys on the servers.
Thank you!
Edit: Ah, my bad, you meant your SSH config, I misunderstood.
I assume you're talking about blocking the document root of your web server, because at least on stock Ubuntu, you can't 100% block the root user from accessing anything (e.g., on Linux, a logged-in root can always use CAP_DAC_OVERRIDE to override permissions). Among other things, that's why a rooted Android phone can access apps that even the app developer doesn't want them to.
Here, they're talking about setting up an ssh key for the root user somewhere that the ssh server is aware of. They certainly won't put it in a directory like a document root such as `/www`. Probably they put it in `/etc/ssh`.
Except for root exploits.