thumbnail buildkite/sockguard: A proxy for docker.sock that enforces access control and isolated privileges