To me the argument was pretty simple: if running software as non-root is important--and you clearly think it is--but it is even slightly annoying to write software in a container that doesn't run as root (as maybe it now has to have a special user and internally manage these users; the comment you responded to showed this with de facto evidence) then it seems pretty obvious this shouldn't be an abstraction that people who make containers have to deal with... let them write everything to run as root and then add a damned command line flag to the container runtime to run the container not as root. I don't use containers (I am too deep into security to pretend they are a security boundary and I know too much about toolchains to feel they solve actual deployment problems), so I am frankly shocked this isn't already how they work :(.