How Docker Sandboxes AI Agents (Before They Break Everything) | Docker's AI Guide to the Galaxy