Currently root/su is configured on gliderlabs/alpine that su from normal user to root is possible without providing any password (just writing "su" and pressing Enter). I find that default bit problematic as any service should run as normal user and not root, but currently there is no gain in that. If attacker is able to gain normal user - he can easily escalate its privileges. Therefore, I think default should be more secure.