In default docker installation on most Linux boxes, communication to docker socket itself requires elevated privilege. You can't even do `docker ps`.

In jobs I held - people who can pull images and run container on servers, they also could install stuff if they wanted. Is running privileged containers blocked? It just seems something broke down in engineering process, if developers has to bypass admins to install stuff on a server. What happens if that server crashed and burned?