It means that if someone breaks out of your container, they can only do things that user can do.

Can that user access your private documents (are these documents in a container that also runs under that user)?

Can that user sudo?

Can that user access SSH keys and jump to other computers?

Generally speaking, the answer to all of these should be “no”, meaning that each group of containers (or risk levels etc) get their own account.

Not quite, I have to go through out of box, and then join it to the domain, but then yes!

Applies security policy, install apps, disables bloat, login in with central username and pass, get mapped drives etc

I have a Windows AD domain and have my preferences and some apps as GPOs.

In the server world we use Ansible, or in some cases maybe PowerShell DSC.

Ansible is much more focused on Linux and orchestration, but does have some support for Windows, and DSC is for Windows Servers.

Both use YAML or similar structured config to impart a state, e.g.

- name: Install Firefox
  Ansible.builtin.package:
    name: firefox
    state: present

Meaning that ansible does the legwork to make sure FF is installed.

No, this is

• buying a surface from Microsoft
• immediately wiping it and installing Linux
• Microsoft then forcing you to authenticate using the device that is only tied to your account via purchase, and NOT login records, AND disabling other forms of auth