running as a separate user helps, but standard containers still share the host kernel. if the agent hits a kernel exploit, it owns the machine. we use gVisor to intercept syscalls so the workload is fully isolated from the host. adds some overhead but it's safer than relying on standard linux permissions.