A Docker container is containment, not a credential boundary

The RubyGems story has a detail that keeps tripping me up. The "GemStuffer" gems didn't sneak...