On: Don't expose the docker socket, even to a container

[jkyle]

I know from Joe Beda's talk [1] they run vm's inside containers for scenarios where they need a managed os. And that those containers run on bare metal. But I can't speak to the reverse not being an employee or authority on Google's internals.

1. https://speakerdeck.com/jbeda/containers-at-scale