docker: Document that policy allows agents to bypass sandbox. Mention podman as safer alternative.

[mnylen]

This is probably known and unavoidable, but it may be worth documenting as unsafe: --enable=docker lets an agent bypass the sandbox’s filesystem restrictions. Because Docker can access the host filesystem, an agent could run an existing local image, mount the user’s home directory, and extract/overwrite files from it.

A very simple reproduction:

safehouse --enable=docker docker run --volume=$HOME/.zshrc:/flag --rm -it alpine:3.22 cat flag

Prints your .zshrc. Assumes alpine:3.22 is already pulled locally.

[black-snow]

You could just file a PR against docs/.

[davidfstr]

In case you're looking for a solution, podman presents a docker-compatible interface and should be runnable from inside a sandbox, limiting its filesystem access that way as any other sandboxed process. I haven't manually tested though.