The SSH tunnel server will run inside its own Docker container. It is necessary to give user-level shell access in order to generate the reverse tunnel to the client devices. Keeping the SSH server isolated to it's own Docker container reduces the threat of giving out shell access.
It may be possible to allow reverse SSH connections without granting shell access to the server. Exploring this option needs to be a high priority.