Running an agent in Docker is the starting line, not the boundary.

With Agent Zero, what actually decides what it can reach is the bridges you enable:
- where each model slot sends data (chat, utility, embedding, browser, vision)
- host file read/write (F3) and code execution (F4)
- Docker browser vs your own browser, and whose cookies
- every plugin and MCP server

List those and you've got your real boundary. Full map, checked against v2.14:
https://cryptodecentral.co.za/notes/agent-zero-container-is-not-the-boundary

#localAI