Disposable, hardened Docker sandbox for running untrusted code & deploying safely — read-only root, dropped Linux capabilities, and a whitelist egress proxy so malicious deps can't read your keys or phone home.