I use --dry-run when I'm coding and I control the code.

Otherwise it's not very wise to trust the application on what should be a deputy responsibility.

Nowadays I'd probably use OverlayFS (or just Docker) to see what the changes would be, without ever risking the original FS.

How do you easily diff what changed between Docker and host?