For that I'd use OrbStack or a VM. It creates bridge devices with a unique address/range for my dockers automatically. I can firewall / isolate it. OrbStack als

For that I'd use OrbStack or a VM. It creates bridge devices with a unique address/range for my dockers automatically. I can firewall / isolate it. OrbStack also supports nix btw. OrbStack runs a (lightweight) VM internally, so it's not completely the same. That said, I personally don't want nix on my system. I'd either want it overlayed (similar to what orbstack does), or as the OS itself. Cluttering my os with nix, or any development installations drives me nuts. I prefer having my shell tool, and have many isolated / COW-toolsets for my use. Almost no (cli/*nix) application requires more access than the CWD, and depending on how much I distrust it, I'll block network access as well.