default docker installs are pretty unsafe as-is, so at least power it down a bit like no netwoork, no shared root acess (run it with its own user etc) i mean docker basic stuff but