To clarify, I'm talking about our use of containers at dotCloud, which is a multi-tenant environment.

Docker _does_ allow running processes as root inside a container, and it also allows dropping privileges to the uid of your choice. It all depends on your particular use case.