Docker alternatives for AI agents: Podman, bwrap and Firejail