"You know you should run your code and agents in a sandbox, but most tools need configuration and setup that’s hard to get right."

This is very true. Having been a user of heavily-customised vagrant boxes for a long time I've been spending a fair bit of time lately on this.

But my own stupid old-fashioned view is that it's probably worth learning cloud-init if you never have. Deploy your VMs on your own machine with multipass, same deployment works with little change in the cloud.