Container isolation is sufficient — agents can access the full filesystem. Absolute paths are passed through as-is.