Running facebook in a separate container is also an essential safety mechanism.

Yes!. And that container is in a Ffx instance, accessed as a remote app (here now but diff container).