Many of the serviceability tools must be run as root to interact with containerized Java apps (see JDK-8255008).

In Docker's design, regular users interact with the containers through the Docker Daemon. There's a plugin API to add extra functionalities into the Docker Daemon:

https://docs.docker.com/engine/extend/
https://docs.docker.com/engine/extend/plugin_api/

We should investigate if it's possible to use a plugin to allow regular users to use serviceability tools such as jcmd to interact with containerized Java apps.