well put, it’s about the knowledge accumulated along the way. thank you so much!

Agreed; the silicon can run a container/real sandbox, Apple just won't ship it. Until they do, we're all stuck just SSHing into our Macs as a workaround.