Soma's outside door. Your password first; then the 6-digit code your authenticator app shows for Soma. This sign-in locks after two idle hours.
or
Soma runs as the moosa user. The shell can do what that account can, which includes Docker — it is not uid 0, and signing in does not make it so.