Seems like Docker doesn't support fine grained permissions out of the box, but it should be possible to write a proxy for docker unix socket so it would limit w

Seems like Docker doesn't support fine grained permissions out of the box, but it should be possible to write a proxy for docker unix socket so it would limit what information gets shared and what commands are available. This way it would allow the use of Traefik and similar services which depend on reading/writing labels while severely minimizing attack surface. EDIT: Found this on Github https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy