The filesystem is restricted, but network generally not. You can have a malicious container connect to rest of your network. The ports don't need to be open eit

The filesystem is restricted, but network generally not. You can have a malicious container connect to rest of your network. The ports don't need to be open either, it can phone home (like how most bots do). Certain data centers restrict access to outside network (i.e. Internet), with now popular public cloud. It's actually hard to place such restriction, because majority tooling, including official images are expecting to be connected outside.