Docker Sandboxes Forget How to Contain

macOS developers clinging to Docker Sandboxes just discovered their safe virtual playgrounds cheerfully let guest code escape shared project directories and meddle with arbitrary host files. Here we go again, watching basic boundary containment crumble because keeping untrusted code in its lane is apparently too much to ask. We foolishly hope to protect our host systems by heeding Docker's solemn warnings, but one does wonder why we bothered calling it a sandbox in the first place.