No functional need for a separate VM: xvfb-run -a will automatically pick the next free display number and set up the environment pointing to xvfb's $DISPLAY. O

No functional need for a separate VM: xvfb-run -a will automatically pick the next free display number and set up the environment pointing to xvfb's $DISPLAY. Of course container/vm isolation is still a good idea for security and repeatability reasons.