I wonder if it makes sense to have a danger tag that causes am-i-isolated to simulate real attack scenarios. For example, attempts to read from /proc/1/environ, access /proc/sysrq-trigger, mount the host filesystem inside the container, read kernel modules, etc. This gives a real-world simulation about the risks present in their environment, without being destructive (hence the simulation)