I use containers in one context (custom container manager) and a regular UNIX account on bare metal in another.

This isn't intended to stop a model like Astra hacking its way out of course, it's more like guardrails on a staircase.

My personal container manager tool has an intercepting SSL proxy and small Javascripts on the host can rewrite or block HTTP requests. The agent gets its own isolated home directory and can't tamper with mine. Local caches like Maven are mapped read/only with a write layer on top.