As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people behind this project. The only thing that bothers me is some mistake that could be made by chance by some developer which could potentially lead to unintended leakage of data from local machine. Like some mistake with paths / unintended copy from some random location / unintended upload / typo in pip dependencies which downloads some malicious library from pip. I'm a bit paranoid on these things especially when the project is new for me and I don't yet know code base and history.
What would be reasonable layer of protection there? I'm thinking about running project from docker sandbox under non-root user mounting only project source tree as a volume. Is it sufficient or what would be more reasonable?