I mean that Steve and you are talking about different things.

Neither Steve nor you or I are are Linux distro packaging experts. I suggest that we listen to the expertise of downstream packagers like Filipe or Miro. They deal with packaging on a daily basis.

By the way you are assuming that all container solutions work like Docker and that all Docker and non-Docker based container solutions allow you to run code as unrestricted, unconfined root. That's a) a incorrect, and b) offtopic for this ticket.