Comment by anarcat

I find the first item in the README a bit misleading:

    Security: plash containers run completely unprivileged.

What this actually means is that plash containers run as the current user, so not as root. But they provide no isolation whatsoever, which I would expect from containers (and which Docker provides, to a certain extent). The README does mention this, but only much later:

    - Plash processes have the same operating system access rights than the process
      that started it. There is no security relevant isolation feature. Exactly as
      with running programs "normally", don't run programs you do not trust with
      plash and try to avoid using plash with the root user.

rootless containers are still a little ways off it seems...