Deleting a Sandbox After Use Is Cleanup, Not Security, Developer Warns

A developer building a disposable container sandbox for an AI agent realized that destroying the container after use does nothing to prevent harm caused while it was running. A misconfigured container can be granted access to sensitive files and unrestricted network access, meaning an agent could exfiltrate SSH keys or other data before the container is ever deleted. The core mistake was conflating cleanup — removing leftover artifacts — with access control, which must be enforced before the container runs. A simple test using Podman demonstrated that a disposable container could read a private SSH key and then delete itself cleanly, leaving no trace despite the exposure. The developer concluded that a sandbox's security model must default to no permissions, granting only the minimum access a task requires, since the live runtime window is where all potential damage occurs.