Hacker News Reader

But now we have Docker, which means all the containerized workflows will run as root....

I suspect you need to be root in the root user namespace... So docker doesn't get this special power...

Docker does not use user namespaces by default (and some features are unavailable when using them).