That's a pretty solid way to handle security. I wonder if there's a way to make sure you're always booting from the same starting point so that nothing is persisted to the image between vm sessions.