Comment by dandarie

That runs the container as a given usee, but doesn't prevent the container running some processes as a different internal user.