My assumption above that I could call the
docker run … prince --control from inside Java in Docker as I already did from Java in host was wrong. Instead, it would require Docker-in-Docker or mounting the Docker socket, both of which does not sound very compelling (
D-in-D,
socket).
So instead, I mounted (docker run --volume) only an empty directory in both containers, where the Java container creates named pipes (via a bash script whose path is passed to the PrinceControl constructor). In the Prince container, inotifywait watches the mounted directory and calls a script which executes Prince reading from / writing to the named pipes.
To my surprise, I did not notice any perfomance penalty. But since noone told me any benefits of smaller containers either, I'll vote for the simpler single container solution.