Docker's new sandboxes aim to contain AI agents for real

With Cloud Sandboxes, devs can keep agents at arm's length