Your AI coding agent's dev container is not a sandbox: docker.sock, --privileged and ~/.ssh mounts

"Just run the agent in a dev container" has become the standard answer to "is it safe to let an AI coding agent run commands on its own?". The idea is good. The container is a box, the agent can break