How to limit container privilege with socket activation

Using socket activation with the –network=none option limits an intruder’s ability to use a compromised container as a starting point for attacks on other devices.

Read More at Enable Sysadmin