[dylanvee]

Container-based virtualization is already here, but without user namespaces root privilege in the container implies root privilege in the host. That's no longer the case; interesting times indeed.

[DASD]

Makes me wonder(or maybe I don't want to know) how Heroku has managed this until now? Only unprivileged users?

[dylanvee]

I don't remember specifically, but that'd be my guess. Non-root users in containers have been fine for a while now.