public access to docker daemon via TCP is disabled by default; enabled via template