Comment by Maakuth

The docker CLI tool is normally executed with user privileges, but there's dockerd, a daemon running as root that actually does the container execution.