I keep my Dev environments in dockerfiles. It's a bit annoying as docker isn't designed for this so I had to figure out how to punch holes in its security for things like access to USB, running graphical apps, etc. I tried to watch to podman but ironically didn't get that to work because it is too secure.

The advantage of all this is that they are separate so you don't need to worry about some embedded IDE or python crap barfing all over your system. I check all the dockerfiles and config files that they install into git. I've been watching nix but it's seems like it's a bit of a Marmite project so I might wait to see if something better turns up.