Agreed. But, seems odd to mention "principle of least privilege" when unprivileged containers aren't the default :)

(yes, I get those are two different scopes of the word privilege)