By default, containers run as root. A container running as root has full control of the host system. As container technology matures, more secure default options may become available. For now, requiring root is dangerous for others and may not be available in all environments. Your image should use the USER instruction to specify a non-root user for containers to run as. If your software does not create its own user, you can create a user and group in the Dockerfile.

Source: https://redhatgov.io/workshops/security_containers/exercise1.2/