Could you run fossilized and sandboxed in a VM? I run Tiny10 for a couple Windows applications that can't run on Wine, completely offline so that there's no need for updates. The system continues to work exactly how I want it to with no Microsoft Surprises.

One of the applications is for tax filing, so I finish the taxes, clone the VM, put the copy online and file. After it gets confirmation, I copy the database back to the fossilized version and wipe the copy. Been doing it for years now.