Even if you ignore that Docker is not a good security boundary.. DoChat bypasses a lot of the protections that Docker does apply. In particular: - --privileged

Even if you ignore that Docker is not a good security boundary.. DoChat bypasses a lot of the protections that Docker does apply. In particular: - --privileged basically gives it the same capabilities as root - Forwarding the X socket means that it has full access to your desktop, including keylogging and so on - IPC isolation is disabled, so it has full access to any shared memory exposed on the host (again, with root privileges)