I have a few machines with docker with tls certs generated by docker-machine using a common CA. I want to give access to one of those instances to another user. How to do this? Do I need a separate CAs for each server to prevent user's access to other machines? What about revoking access?
You need separate CAs if You do not use an authorization-plugin for all the machines trusting the current CA - or an authorization plugin (which often is anyway useful to enable specific permissions for users and not all or nothing).
A authorization-plugin can decide based on CN of the client certificate whether actions. I don't know wether there is some ready plugin around available for download that does what You need. (Probably You just want to continue with allowing every trusted certs users everything except it has one of the CNs You give to the other users, what is very simple but maybe to simple for any public plugin.)