I recommend just setting up a podman container, LLM can do it for you.

Basically Podman is a more secure version of Docker.

I would keep stuff like secret keys outside the container and sign/push commits manually.