> Yes, if/since that user have no access to your apple id and keychain...

Right, these are system accounts. They don't have access to anything except their own home folder and whatever I put in their .bashrc. `sudo` is a pretty easy sandbox by itself and lets me manage their home folders, shell, and environment easily just with the typical Unix-isms. No need for mounting VM disks, persisting disk images, etc.

I don't need virtualization to let Claude Code run. I just let it run as a "claude" user.