Drive-by: make sure docker container does not expose ports on `0.0.0.0` and instead registers to localhost. This way websocket and vnc ports are not exposed to the public internet.
This patch splits out `dockerApi` namespace that is solely responsible for docker API manipulation.