Docker and the Linux Kernel Isolate Your Agent, and Where They Don't | Dark Hacker News