With a default Docker Engine install, a container runs its… (Docker interview question)

Container root is UID 0 on the host kernel, though limited by namespaces, dropped capabilities and seccomp

Container root is UID 0 on the host kernel. Without user namespace remapping or rootless mode, container root and host root share UID 0. Docker reduces the risk in two ways:
• It drops many capabilities (pieces of root power).
• It applies a seccomp profile, which blocks risky system calls.

"Container root is mapped to an unprivileged user on the host automatically" is wrong. That mapping only happens if you turn on user namespace remapping or rootless mode. It is not automatic.

Docker security (https://docs.docker.com/engine/security/)docs.docker.com