So if you let people run arbitrary docker commands on a box, it's pretty much a given that they can affect the availability of the system, heck a low tech versi

So if you let people run arbitrary docker commands on a box, it's pretty much a given that they can affect the availability of the system, heck a low tech version of this would just be to keep spamming docker run on an image and move some files around to chew disk space. If you're looking to restrict what users can do with docker on a host there's a variety of overlay packages you can look at to do that, with things like docker Universal Control Plane. Theoretically there's a Docker authorisation plugin framework which could be used to restrict what user's who connect to the daemon can do, but it's never (AFAIK) really taken off.