Same if an attacker can run arbitrary docker commands.