I tried running the latest builds of debian and alpine but seems to run as root user.
I expected echo $USER should not return root if it returns empty; then I need to verify with the command whoami if that also returns root we have logged into docker container in root mode which can lead to a vulnerability.
docker run -u 0 ...to get a root shell based on an image, and if you candocker runanything then you candocker run -v /:/host busybox cat /host/etc/shadowand similar things to trivially root the host. What are you trying to accomplish, and what do you mean by "rootless"?