Going rootless shrank what a compromised container could do to the host.