docker-sandboxing-cutoff-egress

@eighttrigrams

Sandbox a Docker container so only an explicit allowlist of outside hosts is reachable. Use when running an untrusted/AI agent container and you want a hard egress cutoff with optional inbound port forwarding.