app-emulation/docker: make the docker socket protected