Comment by theamk

I see no inherent problem with that, since it's a very good idea to run agent inside container/VM anyway. And if the only things agent can access is the docker container and /project directory? It can go wild inside.

The variable alone, however, is kinda suspicious - I'd do both variable and command-line flag, just for extra assurance.

(another idea might be to enforce docker, but I know some people run agents in VMs, so this won't work)