If I will allow user to run whatever he want, is he able to do bad thinks to env in which container was executed?
As far as I can see, the answer is yes. So you should probably not give a hacker sudo rights on any container...
A quick Google search gave me the following.
On https://wiki.ubuntu.com/LxcSecurity:
... containers will always (by design) share the same kernel as the host. Therefore, any vulnerabilities in the kernel interface, unless the container is forbidden the use of that interface (i.e. using seccomp2) can be exploited by the container to harm the host.
On http://www.funtoo.org/wiki/Linux_Containers
As of Linux kernel 3.1.5, LXC is usable for isolating your own private workloads from one another. It is not yet ready to isolate potentially malicious users from one another or the host system.
They propose OpenVZ as an alternative.