Recommend using gVisor as a sandbox

docs/resources/client.example.hcl

@@ -9,12 +9,9 @@ client {
 
 plugin "docker" {
     config {
+        allow_runtimes = ["runsc"]
         gc {
             image_delay = "0s"
         }
-
-        # auth {
-            # config = "/root/.docker/config.json"
-        # }
     }
 }

docs/resources/docker.daemon.json

@@ -0,0 +1,10 @@
+{
+  "default-runtime": "runsc",
+  "runtimes": {
+    "runsc": {
+      "path": "/usr/bin/runsc",
+      "runtimeArgs": [
+      ]
+    }
+  }
+}