[rtempaccount1]

The user who runs the docker command can indeed always get root (with a default install, assuming you're not using rootless) but the process inside the container isn't going to necessarily breakout.

That's why --privileged is generally a bad idea, unless you really need it, as it removes the isolation that Docker adds.