pass through --contain

Author: truib

bot/build.sh

@@ -189,6 +189,10 @@ fi
 #  - /dev is needed to access /dev/fuse
 COMMON_ARGS+=("--extra-bind-paths" "${software_layer_dir},/dev")
 
+# pass through '--contain' to avoid leaking in scripts into the container session
+# note, --pass-through can be used multiple times if needed
+COMMON_ARGS+=("--pass-through" "--contain")
+
 # make sure to use the same parent dir for storing tarballs of tmp
 PREVIOUS_TMP_DIR=${PWD}/previous_tmp