Might be my next approach. I had not considered a VM and failed to (quickly) get it to work in a docker/podman container but VM should be straight forward. Thanks for the hint. It's minimally scary the proximity to my actual data but a VM escape should be hard enough.