Running a coding agent inside a container

The thing people reach for the moment they want to stop approving every command — and the one fear it does not remove. A real Dockerfile, a default-deny egress firewall measured before and after, and the four things that break first: a build-arg token that shows up in docker history three times…