> So you can give someone root in one container and that doesn't allow him/her any access in another container or in the host system (barring bugs, of course.)
You can't give root to A in a container and access to the filesystem from the main system as any user. Simply make a suid executable in the container and execute from the main system. Unless uids are jailed as well (and appear on disk as some offset from "root" permissions).