On: Don't expose the docker socket, even to a container

[rwmj]

qemu uses seccomp. If you run your VMs with libvirt, then seccomp can be used to protect the host from qemu easily and routinely.