How do people feel about using docker to prevent this sort of thing? Does it strike the right balance between usability and security?
This is the first I’m hearing of this. Do you have any references?
Besides, bricking software is impossible, bricking refers to physical devices unable to bootstrap anymore.
A soft brick is the actual reference here where you can easily recover from software/re-install.
https://www.techrepublic.com/article/how-to-fix-the-docker-a...
Hobbit jokes aside, yes, it pokes holes in the firewall on the machine hosting docker. It generally creates a lot of firewall rules to isolate or permit traffic to/from containers and expose ports.
Your "safest" bet is probably to only expose docker containers on the localhost interface, and use a reverse proxy (Nginx/Traefik/etc) to expose services. At least that's how i did it when i last ran Docker a few years ago.