Docker doesn't provide a strong security boundary. It's a sandbox only in the sense that it separates the container from the host from inadvertent entanglement (mostly).

(And the nonportability of images is another thing)