[WesolyKubeczek]

> Why not have 1 daemon, rather than 1 daemon per container?

Having a daemon per container has this little advantage that if something manages to bring down one of the daemons, it won't bring down the whole shebang.

[amelius]

Also side-channel attacks.

E.g. if one user downloads a container, and then for another user it is already in the cache, this gives the other user information about the first user.

[Fire-Dragon-DoL]

Isn't this pointless, since if the other user has access to docker, they basically have root access to the machine?

[amelius]

I don't think users need to have root access to use Docker.

[Fire-Dragon-DoL]

No, but unless they run in rootless mode, they can mount any directory and write on it as root

[seba_dos1]

They don't, but if you have given them access to Docker then it's just as if you had given them access to root.