Maybe I'm missing something obvious but, being contained and only having access to specific credentials is all nice and well but there is still an agent that orchestrates between the containers that has access to everything with one level of indirection.