The only group that can’t unionize is the military, there’s plenty of police unions in France.

The Nextcloud AIO container itself doesn’t have access to the backup directory, but it has access to the docker socket (/var/run/docker.sock). Having access to the docker socket means it can perform any docker operation on the host system, in this case starting a separate backup container with the backup directory mounted.