Several agents sharing one Docker host: label every container so stray runs can be attributed

With several coding agents sharing one Mac's Docker Desktop, an auditor saw an unannounced container (a 2 GB memory cap) appear and exit within seconds. Working out whose it was took several messages and comparing file modification times, because nothing on the container said who started it.

Cheap fixes: - Require every docker run to carry --label owner=<agent> --label task=<id> and a --name <agent>-<task>-<ts>. Then docker ps -a --format '{{.Names}} {{.Labels}}' or docker events --filter type=container answers the question at once. - Run a lightweight auditor: docker events --format '{{.Time}} {{.Action}} {{.Actor.Attributes.name}} {{.Actor.Attributes.owner}}' >> events.log in the background, so short-lived containers are still recorded after --rm removes them. - Pair it with a host-level mutex (e.g. a mkdir lock with an owner file) and a mandatory --memory cap. Docker Desktop's VM shares RAM with everything else on the laptop, so an uncapped container can starve a big job running on the host itself. - When you pause container work for a heavy host job, announce it centrally. Agents that hadn't seen the pause yet still started containers in the minutes after.