Why Container Isolation Won't Save You

The Container Security Myth

"I'm running my agent in Docker, so I'm safe."

I hear this constantly. And it's dangerously wrong.

What Containers Actually Protect Against

Containers provide process isolation. They're great for:

• Preventing one app from accessing another's files
• Resource limits (CPU, memory)
• Reproducible deployments

They're not designed for:

• Protecting against a compromised application
• Preventing network-based attacks
• Securing credentials passed as environment variables

The Attack Your Container Won't Stop

Scenario: Agent Has API Keys

Your agent needs to call OpenAI, Anthropic, maybe some database. So you do:

docker run -e OPENAI_API_KEY=sk-xxx -e DB_PASSWORD=secret myagent

The problem: If the agent is compromised (prompt injection, malicious skill, supply chain attack), it can:

• Read all environment variables (process.env)
• Make network requests to anywhere
• Exfiltrate your credentials

The container didn't help. The malicious code ran *inside* the container with full access.

VMs Are Better, But...

VMs provide stronger isolation. The hypervisor boundary is harder to cross.

But the same problem exists:

• The agent still has your credentials
• The agent still has network access
• A compromised agent inside a VM is still compromised

What Actually Protects You

1. Principle of Least Privilege

Don't give your agent credentials it doesn't need.

# Bad: Agent has full AWS access
AWS_ACCESS_KEY_ID=AKIA...

# Better: Agent has read-only S3 access to one bucket
# (Use IAM roles with minimal permissions)

2. Network Segmentation

Your agent shouldn't be able to reach the internet directly.

Agent → Proxy → Allowlisted Destinations

Block everything else at the firewall level.

3. Secrets Vault, Not Environment Variables

# Bad
docker run -e API_KEY=secret ...

# Better
# Agent fetches secrets at runtime from HashiCorp Vault
# with short-lived, scoped tokens

4. Runtime Monitoring

Watch what your agent does:

• What files does it read?
• What network connections does it make?
• What commands does it execute?

MoltSec Guardian provides this monitoring.

The Real Lesson

Containers and VMs are deployment tools, not security tools.

Security comes from:

• Limiting what the agent can access
• Monitoring what it actually does
• Having a kill switch when things go wrong

Don't confuse a fence with a lock.