I have a VM in which I run my general compute. In that VM I use incus linux container and run these tools as unauthorized user of the container. That should be reasonable security while having nice control for resources.