It's not very hard to spy inside a container, or even a bare-metal server if you have hardware access and the network is yours, but why would they even do that when there are a lot of very easy methods of profiling users available to them?

I didn't mention but they also use search results from google.

1) A direct contract with Kagi: Pay less for our services in exchange for user's data ("anonymized"). And google has a lot of services that Kagi may benefit greatly: servers, low latency to google search results, "personalized" google search results without ads and the various sheganigans google uses to promote websites, up to the point where all searches actually comes directly from google.

2) No contract, just get my IP and the search string the Kagi server asks of google at the same time. I don't think there are enough simultaneous searches on Kagi to actually prevent IP-to-search-string pairing. Then do the google-ad-to-IP match on the target sites that I visit.