On the docker side, yes, it runs as root by default. If you want rootless containers, try podman.

For Claude code, no, by default it asks for every command if it’s allowed to run. Either this user allowed all docker commands, allowed all commands, or allowed the to ai decide if the command is safe or not by itself (yes this is a real feature). (If this is Claude code, which I can’t tell if it is)