api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.
CWE-269