I use systemd-nspawn containers with max security options, like user namespaces, syscall filters, no-new-priveleges. Even with the user namespaces I do not run as a root in the user namespaces unless I need to install extra software inside the container.