Hello,
Docker images are a simple tar file. By default they don't have (or shouldnt) have ssh.
If you share a Vagrantfile that includes the instructions to run a docker image, then vagrant will use boot2docker and run commands over ssh.
They could run vagrant ssh and connect to the base box where docker run
they could run docker attach/docker exec and run commands on the docker container
so not sure how you would stop them of doping it.
If they mess up the box, vagrant destroy, vagrant up will make the box back to clean state.
perhaps you could elaborate more, or explain the users they shouldbt be sshing into the box for <insert some reason>
Thanks
Alvaro