I do something similar. I have a base NixOS image in Incus, with whatever tools apply to every project (e.g. Git, OpenCode) already installed. When I work on a project, I spin up a VM instance, use nix shell to add any project-specific tools, then share only the project folder from the host to the guest. This way, the worst the agent can do is destroy my project folder, and I can always restore that from another clone of the repo.

I know a lot of people are using containers for sandboxing, but given how capable the latest models have shown themselves to be for breaking out of sandboxes, I prefer the extra isolation of VMs for this.

I do all this locally - it's an interesting point to able to turn the laptop off but keep the agents running. I might consider running some of these on my homelab server just for that.