I use their official dev container config and limit access to a small list of domains too