[kayson]

This is very easily solved by using a proxy for the docker socket:

https://github.com/Tecnativa/docker-socket-proxy

https://github.com/traefik/traefik/issues/4174#issuecomment-

Create a private network that only connects Traefik and the proxy, and limit Traefik's access to only the GET requests it needs to operate. Now the socket is only exposed to a local container.

[imtringued]

This is such an obvious solution. I am seriously wondering why this isn't integrated into docker directly.

[codethief]

This just adds another layer of indirection. While it improves security, it is not the same as fixing the issue in the first place and making sure that no network-facing part of the system runs as root.