Docker's new sandboxes aim to contain AI agents · Digg