ctx[:sandbox] backed by a long-lived container: one patch row swaps this plugin in and every argv the harness spawns — Bash, Grep, the PTY tools — starts running inside it, with no change to any tool. The workspace is bind-mounted at its own realpath, so host-side file ops and in-container processes see one world at one set of paths; the network is denied by default. Shells out to the docker CLI, so there are no runtime dependencies beyond stdlib.