Meanwhile, is there a way to restrict Dockerfiles, e.g. not allowing users to be root in the container?

I had the impression that this technology was only usable for the "single user machine" use-case, as too many bad things might happen in true multi-user environments - what is quite limiting in a unix world where we are used to multi-user reality since a long time - it was disturbing to see that such a successful tec seemed to ignore that.

However, I am really happy for any updates on this issue, I did not follow Docker development too much, so punish me when I am totally wrong!