docker access == root, as long as you can use volume mounts to arbitrarily mount anything else on the machine to a container. If the user is in the `docker` group, he's effectively root because he can patch around system files.

I once used this to recover lost sudoer access to a machine (have tested this now by editing my sudoer file with a comment):

~ docker run -it --rm -v /etc/sudoers:/etc/sudoers ubuntu bash

# apt update && apt install -y vim

# -- edit /etc/sudoers

# wq!

~ exit

~ sudo cat /etc/sudoers - works, comment is present