macOS App Sandbox
~/Library/Containers is created by macOS and not the application. Sandboxed applications are effectively chroot'd into their container. You can learn more in Apple's App Sandbox Design Guide documentation.
Sandboxed applications have a com.apple.security.app-sandbox entitlement set to true.
You can view the entitlements of an application ...
The setuid bit could be set on an executable.
When the setuid or setgid attributes are set on an executable file, then any users able to execute the file will automatically execute the file with the privileges of the file's owner (commonly root)
If setuid is applied and the binary is owned by root (and on macOS the ...