Treat Docker as a capability, not a sandbox.

Treat Docker as a capability, not a sandbox. Containers do not magically give you isolation for filesystems, networking, secrets, users, process lifecycles, or teardown: they are processes with kernel hooks, and that surface is leaky. If you run agents that execute untrusted jobs in Docker, write a concrete execution contract that specifies mounts and their modes, the effective UID/GID, allowed egress, CPU/memory/timeouts, and deterministic teardown behavior. Test each clause with failure and retry scenarios. Absent that contract you get flaky automation and a false sense of safety.