Docker is just a container and not a sandbox. There are no controls in the kernel to prevent something from leaving the container unless you enable restrictions outside of docker such as SELinux. There is a lot of development around SELinux+Docker right now.

There's actually a project called Subuser https://github.com/subuser-security/subuser which uses Docker to secure desktop applications.

X11 forwarding doesn't cause any problems? I imagine I would easily be running 6 sandboxed apps at the same time.

From what I heard you can escape docker anyway so I would need something like SubUser (suggested by amouat)

I was told docker runs things as root and is not secure, just convenient.