Comment by kristophph

> the OpenShell piece that does the security sandboxing. Gives a lot more granular control over exec and network egress calls. Docker doesn't provide this out of the box.

I think the experimental Docker Ai Sandboxes do this as well: https://docs.docker.com/ai/sandboxes/ Plus free choice of inference model.