docker Three Docker Networks, Fixed Subnets, One Reason: Firewall Rules That Don't Move frontend, socket, and backend are declared with fixed CIDR blocks on vmi2633427 for a reason that has nothing to do with routing and everything to do with what a firewall rule can trust.
docker Don't Give Your Reverse Proxy Root on the Host Traefik needs to know which containers exist and what labels they carry — it does not need exec, write, or image management. tecnativa/docker-socket-proxy is the difference between those two things.
