Also I’m curious how a bonnet can get through a container … outgoing connections should be blocked by default