Recently I faced argument that threw me a bit off balance. I've been suggested that running application bare metal is actually more secure than running it in container.
Reasoning behind that is that even if your containers run on user privileges, still containerd (unless it's running in rootless mode) runs as root so it can be easily exploited, whereas if you're running app on bare metal as non-root user you can get rid of most of deamons running as root so that apart from kernel and systemd nothing actually runs on Linux as root. Everything can be controlled using only sudo and capabilities.
While it seems to somewhat make sense it's really counter intuitive and sounds to me like over focusing only on one aspect of security but I'm struggling to counter this argument.
