Running as root inside a container

• A

  Container isolation is one kernel bug away from being host root

• B

  Root inside a container is automatically root on the host

• C

  Files created by the container will be owned by root and unreadable

• D

  Container runtimes refuse to start processes as root by default