Overlooked option for running these things in containers is macvlan networking. Just give it its own MAC address on the network. Works great and you don't have to compromise on isolation.