A sandbox is not a guarantee against prompt injection, but it limits the blast radius. It should combine filesystem isolation, a separate credential or no credential, and network egress rules. A container with your home directory mounted and your cloud token in the environment is a costume, not a boundary.
Give the agent a scratch workspace, seed it with the files the task needs, and copy results out deliberately. Then destroy it. The prompt injection guide explains what the sandbox is defending against.