Disposable Docker isolation is the pattern I landed on too: a fresh container per run means a misbehaving agent can't corrupt anything that outlives it. The tradeoff I hit was cold-start latency on spin-up. How are you handling that, pooled containers or just eating the startup cost?