So if I get it correctly, I can't protect a Docker Swarm from the user if I do any of this - either the containers or devices will be accessible. I guess I'll have to dedicate a VM then.