The credentials part...

https://docs.docker.com/ai/sandboxes/security/credentials/

It seems to do a good job of not stating the actual threat model anywhere.

Although I use Signal, I actually prefer Threema which you can also use without a phone number.

https://threema.ch/en/home