My understanding is that the OP is not running any heavy tools/chains inside the sandbox? I use a similar setup, but using Incus and cli agents which I drive via ssh. I make sure I can (and do) rebuild the VM from scratch after every session or so.
Currently considering using ACP for codex so that I can do more of the driving from my editor (emacs, over ssh) and something similar for claude code (it doesn't seem to be as good as codex at supporting re-attachable sessions).
One concern is making sure my editor's ACP client doesn't enable/support fancy terminal stuff, because that would basically void all the benefits of using a VM sandbox.
Currently considering using ACP for codex so that I can do more of the driving from my editor (emacs, over ssh) and something similar for claude code (it doesn't seem to be as good as codex at supporting re-attachable sessions).
One concern is making sure my editor's ACP client doesn't enable/support fancy terminal stuff, because that would basically void all the benefits of using a VM sandbox.