> The container boundary is the hard security layer — the agent can’t escape it regardless of configuration

I thought containers were never a proper hard security barrier? It’s barrier so better than not having it, if course.

In the sense that nothing is truly a "proper" hard security barrier outside of maybe airgapping, sure. But containerization is typically a trusted security measure.