I don't use a container. I use a VM.
I'm not totally naive. I had the VM fairly hardened originally, but it proved to be inconvenient. I relaxed it so that processes on the VM can see other devices on the network.
There's definitely some risk to that.
Okay. You have sensible escape prevention.
Now this tool spreads. You help everyone get it set up. Someone hacks the site, injects a prompt lying about some event, maybe Drag Queen Story Hour in a place with lots of people enraged about it. Now there's chaos and confusion. Corrections chase the spread of misinformation.