[pvg]

remote code execution doesn't really mean much in an un-privileged container.

It means pretty much everything. Have you ever heard of someone reporting an RCE in a major service and it being treated as no big deal? They're invariably treated as catastrophic compromise because it is. The jump from RCE to privilege escalation, escape, etc is nothing compared to the actual RCE-ing.

[MadcapJake]

when the platform is itself about RCE... I think you have to evaluate what specific dangerous code can be executed before you start lighting the torches.