After reading about rainloop I could see wanting to run it locally, but as soon as you put it on a VM somewhere you're create a very public access point for all of your email accounts if that server gets compromised aren't you? Seems like creating a weak link on purpose.