On: Don't expose the docker socket, even to a container

[KirinDave]

The first part of your post made sense.

I have no idea what point you're trying to convey with the second part. That applications are not business logic over kernel resources is a curious argument to make.