> Yesterday Claude Code made 5 large edits to my codebase in planning mode (claims it used a bash script instead of standard read/write tools so the guardrails didn't trigger) it's why I put agents in containers.

She asked it to clear her inbox, so she has to give inbox access to her agent. I don't see how containers would help here.