Developer workflow security

If you're on Fedora, using "supermin" to subset the packages you have currently installed into a tarball and then importing that into a container with machinectl is pretty easy. You could build a prototype image and import it fresh for each build. Well at least in theory; I haven't done it yet, but it seemed possible from other avenues I had been investigating.