Safe lab setup for detonating malware — what's the non-negotiable?

Non-negotiables: an isolated VM with host-only networking (or fully offline), snapshots so you revert to clean after every run, and NEVER shared folders or copy-paste to the host while a sample is live. Assume the sample knows it's in a VM and may behave differently — fine for learning. The biggest mistake is a "quick look" on a VM that still has internet or a mapped host drive.