Document CetusGuard as a Docker socket proxy solution

[hectorm]

Summary

I'm a heavy Netdata user and have the need to deploy it securely on Docker. Given how critical it is to give a service access to the socket, I've recently developed CetusGuard, a Docker socket proxy that has no dependencies, is distributed in an image built from scratch and allows to define narrower filtering rules than the currently proposed solution.

A complete example of a Netdata deployment with CetusGuard can be found here.

I'm not quite sure whether the best approach to this PR is to add CetusGuard as an alternative to the current solution or to replace it. I have chosen the second option because CetusGuard covers this use case completely.

[CLAassistant]

All committers have signed the CLA.

[cakrit]

The minimum needed for this PR to be accepted is to add instead of replace, as requested in the review.

But can you please explain why https://github.com/Tecnativa/docker-socket-proxy was so inappropriate for your use case, that you had to develop a new one?

I'd also be interested to know if you tried the HAProxy method mentioned in one of the docs, or why you think it wouldn't work so we can improve that part too.

[hectorm]

There are several reasons why I did not use that project:

• It does not allow to restrict endpoints enough (e.g.: I'd need finer-grained restrictions Tecnativa/docker-socket-proxy#15).
• It does not support TLS (Add TLS support? Tecnativa/docker-socket-proxy#12).
• It is not a very active project, the last update of the latest tag is more than 2 years ago (although there is a more recent nightly tag, but it does not give me confidence).

My first thought was to create my own image with HAProxy, but since it was not a too complicated problem to implement from scratch, I decided to develop my own solution to have more flexibility. The main features are:

• Allows to define narrower filtering rules (in the case of Netdata, it is possible to define a rule for exactly the one endpoint that is needed: GET %API_PREFIX_CONTAINERS%/%CONTAINER_ID_OR_NAME%/json).
• Supports Unix sockets and TCP with TLS client authentication in the backend and frontend.
• Supports connection hijacking (although this does not apply to Netdata).
• It has zero dependencies.