Hmm, I assumed part of the issue wasn't kernel privilege issues or escaping the container or anything, but that granting gid 0 hands the app write access to its own runtime. As in, the ability to do things like rewrite the JAR it runs (along with a bunch of other executables).