I'm no expert, but the kernel is shared between all containers and the host.

I don't believe the kernel maintains separate page caches for each container; a malicious CI job could corrupt a binary from any container, or the host.