This is the way: vm. I'm using vmware workstation though on a ubuntu desktop host to run my node (just switsching from citadel to start9). If you change config, just take a snapshot and delete it if all works well. And you backup the vm to an external drive.

Another benefit: You can have small offline (not connected to the internet) encrypted VMs with sparrow or electrum, export the xpub for a watch only wallet. I don't use hardware wallets ...