"or is there something more tailored out there?"

They're just going to sell you Docker isolation and call it something else.

I mount only the project folders I want my AI to see, and it has no keys to anything otherwise. If can push and deploy using the same project files but from my host machine, manually.