It’s true that containers were built for reproducibility rather than security, but it’s also true that they can be a helpful tool in securing an environment. Not the ONLY tool, but a helpful one, as they implement kernel namespaces, and, also, tools like podman give you easy access to seccomp-bpf as well. I’ve personally used containers as part of a sandbox for an AI agent, but I integrated quite a lot of security components apart from the container itself, including proper firewall rules on the host level, a landlock ruleset inside the container, a custom seccomp-bpf profile, DNS allowlisting to avoid DNS data exfiltration, and, of course, basic container hardening stuff, like setting the filesystem to read-only, or setting proper uid/gid mapping. There’s a lot you can do with it, but simply containerizing an application won’t secure it by default.