Well privileged has been mainly put there because ebpf APIs do not work otherwise and we are already inside a VM, it doesn't need any additional security. Docker is used only because we have to run a newer distro.