[shykes]

Docker itself requires root privileges to place processes in different namespaces, manipulate their control groups etc.

However, you can very easily drop the privileges of the application running inside each container, with "docker run -u <USER>". This is definitely recommended for several use cases, for example running untrusted code on shared hardware.