The official "Multi-Account Containers" extension does that. Honestly I don't understand why it's not built-in, because as you mention without it it's hard not to "leak" outside of the containers.

With it you can associate domains with containers and tell Firefox to always open them in a container. It will also automatically un-containerize if you follow a link to a third party domain. Basically how I expect containers to work.

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Holy crap thank you so much for this! This was the primary thing I complained about for containers and why I never bothered to use them. I completely agree this should've been integrated with it and it makes no sense to me why. Containers as it is are pretty tedious.