I need to give low-level users access to various Jenkins jobs and I want to run Jenkins as a Docker container on my hosts.
I understand that if a user (through sudo or whatever) can access the Docker daemon then I am effectively giving up superuser access on my hosts due to Docker's capabilities (mounting the root filesystem etc).
What is the best way to protect my Docker daemons from Jenkins? The jobs need to be able to start containers etc.
Does Docker 1.10 address this?