> Even if you connect securely, you still essentially have root access on the host machine. Your original point was about the pain of sharing the Unix socket t

> Even if you connect securely, you still essentially have root access on the host machine. Your original point was about the pain of sharing the Unix socket to control other containers, so that's why I brought up the API approach. It's been a while since I used Docker, but have you tried enabling user namespace remapping[1]? I remember it working as documented, and don't see why it wouldn't work remotely or DiD. There's also experimental rootless support since 19.03[2], maybe give that a try. Other than that, make sure you trust the images you run, or preferably, inspect every Dockerfile, ensure that the process runs as an unprivileged user, and build everything from scratch yourself. I agree with you that this is a major security issue, but we've known that since its introduction, and things seem to be improving, albeit slowly. Thankfully, nowadays there is other OCI-compatible tooling you can use and sidestep Docker altogether. Podman[3] is growing on me, mostly because of rootless support, though it's not without its issues and limitations. [1]: https://docs.docker.com/engine/security/userns-remap/ https://docs.docker.com/engine/security/userns-remap/ [2]: https://github.com/moby/moby/blob/master/docs/rootless.md https://github.com/moby/moby/blob/master/docs/rootless.md [3]: https://podman.io/ https://podman.io/