Need to be careful that Docker and LXC both default to unprivileged, however they use the term to mean different things.

If you say “don’t run your containers as root on the host”, this matches the issue better.