Yeah I used to use dev containers. Containers aren't generally a secure sandbox. They're a great guardrail for preventing accidents, but not so much with a malicious prompt injection. (I might be overly paranoid about these things.)

For tool version management, I usually set up a Nix Flake for each project (which also works inside dev containers).