Docker considered harmful - Quantum

This may seem extreme, but fundamentally, this boils down to several things: 1. The Docker daemon’s complete overreach; 2. Docker’s lack of UID isolation by default; 3. Docker’s lack of … ^2^… it’s quite likely for the container to be running as the user you are logged in right now! Isn’t that comforting? You can turn on UID namespaces, but the process is super painful and doing so wipes out the entire Docker state, requiring *all* images and containers to be recreated. It can also only have one UID namespace for all containers running under the same Docker daemon, which isn’t what I’d consider sufficient isolation between containers.