No way, you're right, they actually tried to make it kind of sensible. Too bad there's also: Steal my credentials (temporarily, but still...) to access remote

No way, you're right, they actually tried to make it kind of sensible. Too bad there's also: Steal my credentials (temporarily, but still...) to access remote systems without restriction: RUN --mount=type=ssh Access TCP and UDP ports without restriction, including anything exported by any other container I'm running, because Docker has no real security model RUN --network=host Outright pwn me, but only if "entitiled": RUN --security=insecure