To be honest, this security nightmare also covers other contemporary "container" formats such as docker.
Running docker containers as a non-root user is unfortunately still not a widespread practice. That means that any root process within a docker container has root on the host.
Only if you run with no isolation / user namespace. And even without that, you need to run with `--privileged` to get access to interesting capabilities. It's not as simple as container root == host root.
Are user namespaces enabled by default, or are they something that you have to enable and then spend time dealing with all the containers that weren't written with them in mind?
Running docker containers as a non-root user is unfortunately still not a widespread practice. That means that any root process within a docker container has root on the host.