"You know you should run your code and agents in a sandbox, but most tools need configuration and setup that’s hard to get right."

This is very true. Having been a user of heavily-customised vagrant boxes for a long time I've been spending a fair bit of time lately on updating my skills for this.

But my own stupid old-fashioned view is that it's probably worth learning cloud-init if you never have. Deploy your VMs on your own machine with multipass or whatever, and the same deployment works with little change in the cloud.

That's been the approach I have settled on, but only after a disappointing experience with Apple's "Container Machine" , which is both quite bothersomely insecure by default (your whole home directory? mounted rw? in a VM with an agent? really?) and from there sort of cumbersome/idiosyncratic.

Docker SBX is neat but the Docker account login aspect is annoying to me.

There is an SBX-like example in the Apple Container examples repo:

https://github.com/apple/container-examples/tree/main/contai...

Keep meaning to try it.