Docker puts the agent in a microVM, but it can still edit your project
Docker Sandboxes isolates the kernel, daemon, network and credentials inside a microVM. But its default mode still mounts the workspace read-write. “Sandboxed” is not one trust boundary.

