Ask HN: How are you sandboxing your coding agents?

I've seen a few articles here using bubblewrap, vagrant, VMs, even docker to sandbox coding agents to avoid the inevitable disaster. I've personally been using a headless VM but it's quite resource intensive and I'm wondering if there are better ways to do this.