The second question about a container is whose name its process runs under. The writer container exports data into the ~/share-lab directory, and that directory is yours.
See whose file it is
In ~/share-lab, look at the files, ask for id inside the writer container and try to append a line to export.txt.
First, predict
The ~/share-lab directory is yours. Who owns the export.txt file the container wrote there?
Now start the exercise, run the command and compare your prediction with the output.
A container's processes run on the same kernel as the rest of the machine, and file permissions are checked by the same kernel — by the UID number. Without options, a container's main process gets UID 0, and to the kernel that is the machine's root. That is why export.txt belongs to root and you cannot append to it.
The same UID 0 goes to whoever finds a vulnerability in the container's program: everything mounted into the container from the machine can then be changed as root.