Are putting the agent core and the workspace in separate containers? I do a limited version of that to prevent runaway tests etc from stopping jobs but making it a stronger boundary seems like a good idea.