Locally running Docker Sandboxes built with the --clone flag work pretty good for me so far. The naming is a bit confusing here: these are not containers, this is a completely separate product by Docker using MicroVM-s for sandboxing. Devex has been good and the isolation is pretty solid this way, the big downside is that it's not open source. If someone releases and maintains an open source implementation that provides similar devex I'll jump ship immediately.