Sandboxing an Agent That Executes Code

A concrete container configuration, what it does and does not stop, and the six escapes that get forgotten because they are not kernel bugs.