Docker by default needs root to spawn containers. You can configure it to be rootless but most deployments I see are just root.

Heck you can even get a root shell escalation if you know what you're doing: https://gtfobins.org/gtfobins/docker/