Indeed. You can use filesystem permissions to lock the socket down, and do client auth via the PID and/or UID of the client process instead of at the HTTP layer

Indeed. You can use filesystem permissions to lock the socket down, and do client auth via the PID and/or UID of the client process instead of at the HTTP layer. For example you can assert that the client is from the Docker container that it's claiming to be from, by checking that its PID is in the list of PIDs in that container. Of course this also requires some discipline from the user, like not running containers as root, and not running containers with Docker socket access (which is as good as having root).