I understand that. I'm saying that wrapping all the dev containers up inside a single VM serves to further protect the host system from the dev containers.