Threat model for me is more "whoops it deleted my home directory" rather than some elaborate malicious exploit.
pct exec $CTID -- sh -c "mkdir test"
I've got a script that makes an arch lxc and turns it into a template.
And then bash scripts that deploys it with whatever custom stuff is needed (volume mounts, podman, files pushed into container etc).
Also a pacoloco server (arch/pacman cache) so that all the building and updating for everything is fast & not hitting the upstreams unnecessarily.
Terraform or Ansible also works for this but decided bash is ultimately less moving parts
Threat model for me is more "whoops it deleted my home directory" rather than some elaborate malicious exploit.