Airlock

You run an install. A package you have never heard of, four levels down the tree, runs a postinstall script with your permissions. It can read your SSH keys and your cloud credentials. Most developers know this and install anyway, because the alternative is inconvenient enough that nobody does it. Airlock makes it convenient: read-only root, dropped capabilities, egress denied by default, and a short allowlist of the hosts a build actually needs. Defaulting to deny is the decision that matters. A sandbox you have to configure before it protects you gets configured once, permissively, and then forgotten.

Two separate problems solved together: the container cannot persist or escalate, and it cannot reach the network except through an allowlist it does not itself control. The second is the one that matters, because stolen credentials are worthless if they cannot be sent anywhere.