I probably should have mentioned that it’s a quirk of Docker because it’s a quirk of Linux Containers in general.
Essentially they’re similar to the *BSD jails, but actually much stricter in how they isolate things.
Personally, I’m not a fan of them, but I actually fully understand why Discourse uses Docker. The isolation actually makes it much more difficult for host changes to affect Discourse. In fact, except for a kernel update that broke Docker briefly awhile back, I’ve never had an upgrade of the host break Discourse. 