Defence is best in depth. Put all your login etc on a separate box. Have that box send code to the dedicated runner box to be run. Boot your runner's host OS

Defence is best in depth. Put all your login etc on a separate box. Have that box send code to the dedicated runner box to be run. Boot your runner's host OS from CD and reboot each midnight too. Plus the zerovm in docker and everything you already have. And look at firewalling and rescinding capabilities to further isolate the sandbox.