Our image uses a non-root USER, but Docker still runs as root on the host
A worked deployment uses a Dockerfile USER instruction and runs the application as UID 1001. An audit of the host still shows a rootful Docker daemon. The team assumed the Dockerfile changed both processes. What boundary did the instruction actually change?