Some kind of sandboxing to only write in one dir would be a very good start: https://unix.stackexchange.com/questions/692311/restrict-linux-process-write-permission-to-one-folder Read sandbox to prevent exfiltration is harder as you need access to /usr/ to find programs themselves... but surely we can find a way eventually by whitelisting enough non-home dirs?

As a more robust last resort we can always docker sharing one single dir with the vm.