Your AI Agent Can Run `rm -rf /`. Put It in a Sandbox.

Docker Sandboxes run Claude Code and Codex inside a microVM with its own kernel and Docker daemon: the trust boundary, the 10-minute setup, and the modes people miss.