But they can no? With a sidecar and some docker network-fu.

I encountered the same challenge building my toy sandbox. I wanted to use containers because that's what I know best.

The harness is launched in an internal only network. There is a sidecar container that provides mitm credential injection/proxy. I got HTTPS and SSH to work so far.

Claude code was quick to build it. No doubt it's copying previous work in this space though, so I know my work is not that original.

I'm testing all the llms that can be used for pen testing right now to see if/how they manage to escape it. Without a kernel exploit I doubt it's possible (not a very high bar I know).

I'm researching the space. Happy to learn more. Some links in my profile if you're interested.