CONTAINERS/SANDBOXES: these seem to apply mostly to files and code, but thinking of
vulnerabilities as they relate to containers has sometimes been useful. For example, directory
traversal and some Java sandbox escaping works by using syntactically valid manipulations that
produce references to resources outside the container, which are semantically invalid relative to