I have a docker image that consists of a python script, which takes some arbitrary source code and eval()'s it
Let's say the code was rm -rf. Would this delete anything on the host's file system? 
I think the answer is "no", but I just want to confirm before trying it out.
So on the one hand, yes, Docker's filesystem isolation means that commands like rm -rf by default can't do more than corrupt the container's filesystem.
There's a fairly wide variety of things people do routinely that weaken this.  Do you bind-mount your host's source code into the container to simplify development?  Malicious code could corrupt your development tree, or surreptitiously slip commits into your .git directory.  Bind-mount the Docker socket into the container so you can launch other containers?  It's trivial to take advantage of that to root the whole host.
This is also just a narrow slice of what's possible with eval().  Linux kernel exploits happen fairly regularly, and since Docker containers share the host kernel, eval()ed code could take advantage of this.  There are also things like cryptocurrency miners that aren't dangerous per se but you still don't want to be running them for other people.
As far as your narrow question goes, yes, Docker gives you protection from malicious code corrupting the host filesystem, but there are still a lot of other things malicious code could do and I would not try to use a Docker container as a sandbox for truly untrusted code.
Can "rm -rf" on a docker container delete files on the host?