Why should containers not run as root?

If an attacker escapes the application, root in the container maps to root on the host unless user namespaces are used. Add a USER instruction, drop capabilities (--cap-drop ALL), and use a read-only root filesystem where possible.