Containers and VMs are really annoying to work with for these kinds of applications. Things like agent-safehouse and greywall are better imo

I've honestly found containers a breeze for such use cases. Inference lives on the host, crazy lives in an unpriv'd overlayfs container that I don't mind trashing the root of, and is like nothing in resources to clone, and gives a clean mitm surface via a veth. That said, greywall looks pretty dope!