I always like to see new projects using containers. Two questions:

- how is your devbox.json file different from a Dockerfile/Containerfile?

- does your project attempt to provide any isolation security-wise?

> does your project attempt to provide any isolation security-wise?

Considering that they provide Docker-in-Docker by default, this would have to be a "no" right now. Having the ability to launch Docker containers is equivalent to having root access on the Docker host by default.