docs(sandbox): what the Linux sandbox does in a container, measured

docs/GUIDE.md

@@ -1219,6 +1219,31 @@ execution instead of running unconfined. Install the platform sandbox backend
 `[sandbox] bash = "off"` to explicitly restore the pre-1.16 unconfined shell
 behavior. On Windows the compatible value is always `off`.
 
+### In a dev container or Docker
+
+Bubblewrap has to create user and mount namespaces (and a network namespace for
+a closed network), which a default container blocks. Measured on Docker Desktop
+(Linux VM, Debian 12, bubblewrap 0.8.0), by launching a confined command under
+`enforce` in each configuration:
+
+| Container configuration | Sandbox | Reported cause |
+|---|---|---|
+| bubblewrap not installed | unavailable | `sandbox.no_bubblewrap` |
+| default `docker run`; seccomp unconfined only; `SYS_ADMIN` only; seccomp and AppArmor unconfined without `SYS_ADMIN` | unavailable | `sandbox.bwrap_namespace_denied` |
+| `SYS_ADMIN` with seccomp and AppArmor unconfined | works with the network open; a closed network is unavailable | `sandbox.bwrap_network_denied` for the closed network |
+| the above plus `NET_ADMIN`, or `--privileged` | works, network open or closed | none |
+
+- Both `CAP_SYS_ADMIN` and an unconfined seccomp profile are needed; either alone is not enough.
+- Reasonix does not look for a container. The message comes from what bubblewrap
+  could and could not do, so a container granted those privileges gets its
+  sandbox, and one that is not is told which privilege is missing.
+- Granting them widens the container itself. The other choice is
+  `[sandbox] bash = "off"`; the container is then the only boundary, and what
+  you mount writable (a credentials file in a bind-mounted workspace included)
+  is writable by every command.
+- Only the Linux sandbox was measured. A Dev Containers or Codespaces session,
+  rootless Docker and SELinux hosts were not run.
+
 For coding-quality reports, run `reasonix doctor quality <branch-id-or-path>`
 (add `--json` for structured output). This reads the selected session but emits
 only content-free counts and profile categories: model family, runtime profile,

docs/GUIDE.zh-CN.md

@@ -964,6 +964,23 @@ MCP 等独立沙盒继续使用自己的隔离规范，不继承父会话临时
 没有可用 OS 沙盒时，`bash = "enforce"` 会拒绝 bash 执行，不会无沙盒运行。
 Windows 上兼容的值始终为 `off`。
 
+### 在开发容器或 Docker 里
+
+bubblewrap 需要创建用户命名空间和挂载命名空间（关闭网络时还要网络命名空间），默认容器会拦下这些。在
+Docker Desktop（Linux 虚拟机、Debian 12、bubblewrap 0.8.0）上，用每种配置各启动一条受限命令（`enforce`）实测：
+
+| 容器配置 | 沙盒 | 报告的原因 |
+|---|---|---|
+| 没装 bubblewrap | 不可用 | `sandbox.no_bubblewrap` |
+| 默认 `docker run`；只解除 seccomp；只加 `SYS_ADMIN`；解除 seccomp 和 AppArmor 但没有 `SYS_ADMIN` | 不可用 | `sandbox.bwrap_namespace_denied` |
+| `SYS_ADMIN` 加解除 seccomp 和 AppArmor | 网络开放时可用；关闭网络时不可用 | 关闭网络时为 `sandbox.bwrap_network_denied` |
+| 再加 `NET_ADMIN`，或 `--privileged` | 可用，网络开放或关闭都行 | 无 |
+
+- `CAP_SYS_ADMIN` 和解除 seccomp 两样都要，缺一不可。
+- Reasonix 不去判断是不是在容器里。提示来自 bubblewrap 实际能做什么、不能做什么：给了这些权限的容器能用上沙盒，没给的会被告知缺哪一项。
+- 给这些权限会放宽容器本身。另一条路是 `[sandbox] bash = "off"`；那时容器就是唯一的边界，你挂载成可写的东西（包括绑定挂载的工作区里的凭据文件）每条命令都能写。
+- 只测了 Linux 沙盒；没有跑真正的 Dev Containers / Codespaces、rootless Docker 和 SELinux 主机。
+
 反馈编码质量问题时，可运行 `reasonix doctor quality <branch-id-or-path>`（加
 `--json` 输出结构化结果）。命令会读取指定 session，但只输出不含内容的计数与
 Profile 分类：模型家族、运行模式、协作/审批模式、消息和工具调用数、验证与已持久化的