http://treasurechest.i2p/setup.html
When I restart the VM, it's always back to its original state (this has the happy side-effect of making permanent logs impossible, even if I got the logging configuration wrong). And I use the 'restrict=on' network option to block all outgoing network traffic from the VM, and allow incoming traffic only to the chest's services. With this setup, even a complete OS-level compromise of the VM would be unable to endanger other machines, and would eventually be automatically...