couldn’t we contain it by having it on an air gapped system? Seems like a lot of work to properly implement in practice though; e.g if updates aren’t handled correctly could be another escape vector.