Containers aren't a sandbox:

https://news.ycombinator.com/item?id=46405993