[jeffbee]

OK, that's not a complexity trade I'd be willing to make, but I can see it. However, that's unrelated to the nonsensical reason given by the article.

[cats4256]

In traditional Docker installs, you (can) run as real UID 0 (and many containers do) with CAP_KILL [https://docs.docker.com/engine/reference/run/].