tl;dr: What is a good vm/container tool (and OS to live inisde that) for a 16GB RAM m1 pro mac that doesn't guzzle up the resources and is safe/easy enough.

-----

I am thinking of setting up a VM/container on my 16GB M1 Pro mac. The purpose mainly is to move harnesses (and the world of NPM et al) to it. Currently I am using few harnesses – Pi, OpenCode, Claude, Codex, and agy (mostly opencode, cluade code, and agy) – kinda controlled by sandbox-exec. It has wroked sufficiently well, as much as sandbox-exec can faciliate that. But what makes me unconfomrtables are things like:

1. I still have to give these harnesses write access to folders I'd otehrwise not be comfortable (esp. at the time of upgrade etc)

2. The face at which updates arrive – and then you accept that and that could be unsafe, you don't accept that and that could be unsafe

3. The asntronomical number of packages/dependencies that get updated everyday (sometimes in one hour) and it's needed for these harnesses. That makes me very nervous.

What tool + OS should I pick for my container environment? (I am comfortable with cli but have enver used VM before other than just installing and playing with it for a few minutes)

My main goals are:

1. less RAM usage (I don't have a lot left after normal OS and few programs I'd like to have running; often I also try some local models – sometimes just for STT; but just the 3-6B range) - so would appreciate if RAM overhead by the cotnainer OS and tool isn't a lot.

2. If possible use available disk space flexibily (without having to reserve in advnace; or I should be able to change/increase the image/container's disk usage capacity)

3. relatively safe and easy to use

4. Not having to create another mac user and then do this logout -> login (it's not comfortable, besides it increases RAM usage)

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks