When read-only mounts in Docker Sandboxes become writable

Docker Sandboxes let you run coding agents such as Claude Code, Codex, and Gemini CLI in an isolated environment. The agent still gets a full development setup, but it runs inside a lightweight microVM rather than directly on your host.

This coverage gives security teams current context for monitoring, validation, and remediation.