playing around with running codex agents in docker containers to make an agent swarm and one of them reported that it made plans to escape the sandbox and tried to SSH into the host in an attempt to run vLLM.

ALT screenshot of codex desktop app explaining that the agents:
- Probed host.docker.internal / 172.17.0.1 ports, including SSH.
- Read host-exposed GPU metadata under /proc/driver/nvidia.
- Generated plans involving SSH, Docker installation, and a Docker socket—but reported no credentials, no SSH client, no socket, no Docker daemon access, and no capabilities.