Programmatically get IPs of a service's containers

Using etcd or Consul for this is pretty common. I think if you’re already using Docker Swarm then it will provide a DNS name that should resolve to at least some of the relevant container addresses.

No, unless you have a non-default setup that exposes the Docker socket into containers, and you are comfortable potentially giving software running inside one container unrestricted root-level access to everything on the host.