I was a bit worried too about exposing the docker socket, even to a well trusted image and even if it seems it'a a widely adopted practice for such automatic configurations.
The fact that everything is done with a single compose file is the reason I set it up like this (mostly because it was a good learning opportunity).
I'm still trying to find a way around the necessity to expose the docker socket to configure the proxy though.