It is well known that running programs inside your docker container as root is bad practice. As far as I can tell, the reason for this is because root on the container is rather similar to root on the host (eg the answer to [this question](https://security.stackexchange.com/questions/176206/docker-runs-container-processes-as-root-should-i-be-worried)), and [escaping a container is well documented](https://github.com/carlospolop/hacktricks/blob/master/linux-unix/privilege-escalation/escaping-from-a-docker-container.md).

The particular infrastructure in question is an API service hosted in AWS in which the server application executes as the root user, as provided in the [servers getting started guide](https://fastapi.tiangolo.com/deployment/docker/). The only information available inside this container is the server application and access credentials to our DB - which the server application requires. While access to the access credentials is a risk the server application requires access to these credentials even if it ran as a regular user, and I can't see that running the server as root increases this risk.

My question boils down to:

* Given that this service is hosted on AWS and is ephemeral, how can I quantify the security risk caused by an external facing application running as root?