Generally, with all those modern unprivileged container dreams...
On the one side there are the people who want to make sure containers can only be run from a user ("rootless"), so that there is no attackable daemon with root/kernel privileges. those people are scared that bec. everything is so complicated somebody will be able to gain full privileges by attacking that daemon from the VM, so they want to have no such daemon.
On the other side there are those people who now can only run as user, who try to get more and more privileges from the kernel into userland...
companies like google, facebook, redhat, are actually spending ludicrous amount of work on all the many related issues creating more and more fine-grained privilege escalation possibilities for these use cases.
it can only end badly IMO.
don't bother, guys