I assume that is why I see gosu [1] used so often for dropping privileges in Docker containers.

It's good to have some explanation as to why su is unsuitable for this.

[1] https://github.com/tianon/gosu