Secure by default is your only way forward

elseif has not written about this yet · Docker describes it this way

The newest worker on your team builds with whatever it finds and never asks what deserves your trust. Our answer is a hardened foundation and a boundary built for agents.