air-gapped containers

[jakecoffman]

Docker has a new experimental feature: air-gapped containers

This could be useful to simplify how the CLI runs an update.

Currently it creates a Docker network so the Updater image can only communicate with the Proxy, and the Proxy is allowed to access to the host network.

With air-gapped containers we could restrict the Updater image to communicate only with the Proxy, but run the Proxy directly on the host instead of in a container.