system-docker or (user-)docker?

[pw Foo]

There are some management containers like

• RancherServer (admin only)
• RancherAgent (admin only, privileged, volume /var/run/docker.sock)
• RancherVM (admin only)
• Nginx-Proxy (separated into two containers)
• nginx (admin only, dynamic config)
• docker-gen (volume /var/run/docker.sock:ro)

So should all run inside (user-)docker or should some moved to system-docker? As system-docker it's separate production / customer containers, but what's about security as system-docker containers?

[Ivan Mikushin]

The rule of thumb here is don't use system-docker unless you really have to: system-docker is basically needed for the operating system core services, like udev and network.