I just have a slack bot running on a VM that sees a message and invokes pi.

It would be trivial for every request to clone a full lxd container and have all the tools and repos required if I wanted to allow it to do even more.

Not sure why anyone prefers to choose locked in options