As if the TCP is less secure? Not necessarily as the TCP sockets here most likely live in a private network between the two containers: you run `podman network create example` and then `podman run --net=example whatever`. This creates an internal network (e.g., 10.0.0.1/10) over which the pods communicate. Only if you want to expose some port would you use `-p` flag to expose it to host LAN, which you then redirect to WAN.

Indeed. You can use filesystem permissions to lock the socket down, and do client auth via the PID and/or UID of the client process instead of at the HTTP layer. For example you can assert that the client is from the Docker container that it's claiming to be from, by checking that its PID is in the list of PIDs in that container.

Of course this also requires some discipline from the user, like not running containers as root, and not running containers with Docker socket access (which is as good as having root).

You can do some weird stuff with Unix Domain sockets, though, like using sendmsg() to pass over an open file descriptor.

Seems irrelevant when running containers.