researchclaw-container-requires-docker-socket-for-experiment-sandbox
AutoResearchClaw runs LLM-generated experiment code that must be sandboxed — running it unsandboxed is a security violation. The researchclaw container must either use Docker-in-Docker or mount the host Docker socket (/var/run/docker.sock) to spin ephemeral experiment sandbox containers per run. This is a mandatory design requirement, not optional hardening.