Earlier quoted context omitted.
I've been doing similar things, just in docker instead of a VM (and doing X11 forwarding via xpra). Not entirely happy with the setup yet; I still need to figure out how to do that with two containers so that the browser doesn't get accidental internet access. Not quite as good as a VM, but better than nothing and easier for me to maintain.
Why do you say "easier for me to maintain"? Are you talking about keeping them updated? That does get to be a pain.
Yep, keeping things updated. Right now I have it set to scrape the torproject web site to extract the location of the latest release, so that `make build` can get me an updated browser.