I don't want to run node.js on my Mac directly anymore, so I've built MyBox. Maybe you find it useful too:
MyBox is built on a fork of apple/container.
* Each box has its own Linux kernel.
* No mounts: Project files get copied.
* Packet filtering: No access to Mac and local network.
* Dedicated user: Apps cannot reach into the box.
* Touch ID/password: To open a shell or copy files.