I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a laptop with an internet connection). I realize virtual machines don't provide complete security and isolation for, say, loading a machine up full of viruses, but I just want to use it to learn about and practice pentesting web apps.
What needs to be done to do this securely? What are some of the risks of running a security-related "sandbox" in a VM on an actively-used machine (as opposed to an isolated machine dedicated to that purpose)?
Edit: Just to clarify, my main question here is about a VM for pentesting a vulnerable web app, not virus/malware analysis, etc.