diff --git a/src/Robo/Commands/Doctor/DoctorCommand.php b/src/Robo/Commands/Doctor/DoctorCommand.php
index d90255200..16b72514d 100644
--- a/src/Robo/Commands/Doctor/DoctorCommand.php
+++ b/src/Robo/Commands/Doctor/DoctorCommand.php
@@ -20,6 +20,7 @@ class DoctorCommand extends BltTasks {
    * @command doctor
    *
    * @launchWebServer
+   * @executeInVm
    */
   public function doctor() {
     $this->doctorCheck();
diff --git a/src/Robo/Commands/Frontend/FrontendCommand.php b/src/Robo/Commands/Frontend/FrontendCommand.php
index 765f5acf1..ea24a1f8c 100644
--- a/src/Robo/Commands/Frontend/FrontendCommand.php
+++ b/src/Robo/Commands/Frontend/FrontendCommand.php
@@ -14,6 +14,7 @@ class FrontendCommand extends BltTasks {
    *
    * @command source:build:frontend
    * @aliases sbf frontend
+   * @executeInVm
    */
   public function frontend() {
     $this->invokeCommands([
@@ -27,6 +28,7 @@ public function frontend() {
    *
    * @command source:build:frontend-assets
    * @aliases sbfa frontend:build
+   * @executeInVm
    */
   public function assets() {
     return $this->invokeHook('frontend-assets');
@@ -37,6 +39,7 @@ public function assets() {
    *
    * @command source:build:frontend-reqs
    * @aliases sbfr frontend:setup
+   * @executeInVm
    */
   public function reqs() {
     return $this->invokeHook('frontend-reqs');
@@ -51,6 +54,7 @@ public function reqs() {
    * @todo add alias for tests:frontend.
    *
    * @launchWebServer
+   * @executeInVm
    */
   public function test() {
     return $this->invokeHook('frontend-test');
diff --git a/src/Robo/Commands/Generate/AliasesCommand.php b/src/Robo/Commands/Generate/AliasesCommand.php
index ab5b48a12..aa65dbb1d 100644
--- a/src/Robo/Commands/Generate/AliasesCommand.php
+++ b/src/Robo/Commands/Generate/AliasesCommand.php
@@ -51,7 +51,6 @@ class AliasesCommand extends BltTasks {
    *
    */
   public function generateAliasesAcquia() {
-
     $this->cloudConfDir = $_SERVER['HOME'] . '/.acquia';
     $this->setAppId();
     $this->cloudConfFileName = 'cloud_api.conf';
diff --git a/src/Robo/Commands/Setup/AllCommand.php b/src/Robo/Commands/Setup/AllCommand.php
index f44b222ce..ab804f195 100644
--- a/src/Robo/Commands/Setup/AllCommand.php
+++ b/src/Robo/Commands/Setup/AllCommand.php
@@ -13,6 +13,7 @@ class AllCommand extends BltTasks {
    * Executes source:build:* and installs Drupal via setup.strategy.
    *
    * @command setup
+   * @executeInVm
    */
   public function setup() {
     $this->say("Setting up local environment for site <comment>{$this->getConfigValue('site')}</comment>.");
diff --git a/src/Robo/Commands/Setup/BuildCommand.php b/src/Robo/Commands/Setup/BuildCommand.php
index 33b7aa3ab..ac3b6fde6 100644
--- a/src/Robo/Commands/Setup/BuildCommand.php
+++ b/src/Robo/Commands/Setup/BuildCommand.php
@@ -25,6 +25,7 @@ class BuildCommand extends BltTasks {
    * @validateDrushConfig
    * @validateMySqlAvailable
    * @validateDocrootIsPresent
+   * @executeInVm
    *
    * @todo Add a @validateSettingsFilesArePresent
    */
diff --git a/src/Robo/Commands/Setup/ConfigCommand.php b/src/Robo/Commands/Setup/ConfigCommand.php
index 0adfafe4c..c799a0792 100644
--- a/src/Robo/Commands/Setup/ConfigCommand.php
+++ b/src/Robo/Commands/Setup/ConfigCommand.php
@@ -16,6 +16,7 @@ class ConfigCommand extends BltTasks {
    *
    * @command drupal:update
    * @aliases du setup:update
+   * @executeInVm
    */
   public function update() {
     $this->invokeCommands(['drupal:config:import', 'drupal:toggle:modules']);
@@ -28,6 +29,7 @@ public function update() {
    * @aliases dci setup:config-import
    *
    * @validateDrushConfig
+   * @executeInVm
    */
   public function import() {
     $strategy = $this->getConfigValue('cm.strategy');
diff --git a/src/Robo/Commands/Setup/DrupalCommand.php b/src/Robo/Commands/Setup/DrupalCommand.php
index 67b5b11d6..d3f6efc62 100644
--- a/src/Robo/Commands/Setup/DrupalCommand.php
+++ b/src/Robo/Commands/Setup/DrupalCommand.php
@@ -18,7 +18,6 @@ class DrupalCommand extends BltTasks {
    *
    * @validateMySqlAvailable
    * @validateDrushConfig
-   * @executeInDrupalVm
    * @hidden
    *
    * @return \Robo\Result
diff --git a/src/Robo/Commands/Setup/ImportCommand.php b/src/Robo/Commands/Setup/ImportCommand.php
index 7ef6b9d7b..0f08908ca 100644
--- a/src/Robo/Commands/Setup/ImportCommand.php
+++ b/src/Robo/Commands/Setup/ImportCommand.php
@@ -18,6 +18,7 @@ class ImportCommand extends BltTasks {
    * @aliases dsi
    *
    * @validateDrushConfig
+   * @executeInVm
    */
   public function import() {
     $task = $this->taskDrush()
diff --git a/src/Robo/Commands/Setup/ToggleModulesCommand.php b/src/Robo/Commands/Setup/ToggleModulesCommand.php
index b5d66bcb4..183820a90 100644
--- a/src/Robo/Commands/Setup/ToggleModulesCommand.php
+++ b/src/Robo/Commands/Setup/ToggleModulesCommand.php
@@ -23,6 +23,7 @@ class ToggleModulesCommand extends BltTasks {
    * @aliases dtm toggle setup:toggle-modules
    *
    * @validateDrushConfig
+   * @executeInVm
    */
   public function toggleModules() {
     if ($this->input()->hasArgument('environment')) {
diff --git a/src/Robo/Commands/Sync/SyncCommand.php b/src/Robo/Commands/Sync/SyncCommand.php
index 8215e1220..79aec781d 100644
--- a/src/Robo/Commands/Sync/SyncCommand.php
+++ b/src/Robo/Commands/Sync/SyncCommand.php
@@ -17,8 +17,8 @@ class SyncCommand extends BltTasks {
    * SSH forwarding.
    *
    * @command drupal:sync:all-sites
-   *
    * @aliases dsa sync:all
+   * @executeInVm
    *
    * @see https://github.com/acquia/blt/issues/1875
    */
@@ -43,8 +43,8 @@ public function allSites() {
    * for each multisite.
    *
    * @command drupal:sync:default:site
-   *
    * @aliases ds drupal:sync:default sync sync:refresh
+   * @executeInVm
    */
   public function sync($options = [
     'sync-files' => FALSE,
@@ -65,6 +65,7 @@ public function sync($options = [
    * @aliases dsf sync:files
    *
    * @validateDrushConfig
+   * @executeInVm
    *
    * @todo Support multisite.
    */
@@ -90,8 +91,8 @@ public function syncFiles() {
    * Iteratively copies remote db to local db for each multisite.
    *
    * @command drupal:sync:db:all-sites
-   *
    * @aliases dsba sync:all:db
+   * @executeInVm
    */
   public function syncDbAllSites() {
     $exit_code = 0;
@@ -122,8 +123,8 @@ public function syncDbAllSites() {
    * @command drupal:sync:default:db
    *
    * @aliases dsb drupal:sync:db sync:db
-   *
    * @validateDrushConfig
+   * @executeInVm
    */
   public function syncDb() {
     $local_alias = '@' . $this->getConfigValue('drush.aliases.local');
diff --git a/src/Robo/Commands/Tests/BehatCommand.php b/src/Robo/Commands/Tests/BehatCommand.php
index fa69123a0..3eca7c3e4 100644
--- a/src/Robo/Commands/Tests/BehatCommand.php
+++ b/src/Robo/Commands/Tests/BehatCommand.php
@@ -96,6 +96,7 @@ public function initialize() {
    * @validateBehatIsConfigured
    * @validateVmConfig
    * @launchWebServer
+   * @executeInVm
    */
   public function behat() {
     // Log config for debugging purposes.
@@ -125,6 +126,7 @@ public function behat() {
    * @aliases tbd tests:behat:definitions
    *
    * @validateMySqlAvailable
+   * @executeInVm
    */
   public function behatDefinitions($options = ['mode' => 'l']) {
     $task = $this->taskBehat($this->getConfigValue('composer.bin') . '/behat')
diff --git a/src/Robo/Commands/Tests/SecurityUpdatesCommand.php b/src/Robo/Commands/Tests/SecurityUpdatesCommand.php
index 8e17388db..b139a9543 100644
--- a/src/Robo/Commands/Tests/SecurityUpdatesCommand.php
+++ b/src/Robo/Commands/Tests/SecurityUpdatesCommand.php
@@ -14,6 +14,7 @@ class SecurityUpdatesCommand extends BltTasks {
    *
    * @command tests:security:check:updates
    * @aliases tscu security tests:security-updates
+   * @executeInVm
    */
   public function testsSecurityUpdates() {
     $result = $this->taskDrush()
diff --git a/src/Robo/Hooks/DrupalVmHook.php b/src/Robo/Hooks/DrupalVmHook.php
new file mode 100644
index 000000000..f2f88ab06
--- /dev/null
+++ b/src/Robo/Hooks/DrupalVmHook.php
@@ -0,0 +1,37 @@
+<?php
+
+namespace Acquia\Blt\Robo\Hooks;
+
+use Acquia\Blt\Robo\BltTasks;
+use Consolidation\AnnotatedCommand\AnnotationData;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Acquia\Blt\Robo\Exceptions\BltException;
+
+/**
+ * This class defines hooks that provide user interaction.
+ */
+class DrupalVmHook extends BltTasks {
+
+  /**
+   * Ask whether user would like to execute on host machine.
+   *
+   * @hook interact @executeInVm
+   */
+  public function interactExecuteOnHost(
+    InputInterface $input,
+    OutputInterface $output,
+    AnnotationData $annotationData
+  ) {
+    if (!$this->getInspector()->isVmCli() && $this->getInspector()->isDrupalVmLocallyInitialized()) {
+      $this->logger->warning("Drupal VM is locally initialized, but you are not inside the VM.");
+      $this->logger->warning("You should execute all BLT commands from within Drupal VM.");
+      $this->logger->warning("Use <comment>vagrant ssh</comment> to enter the VM.");
+      $continue = $this->confirm("Do you want to continue and execute this command on the host machine?");
+      if (!$continue) {
+        throw new BltException("Command terminated by user.");
+      }
+    }
+  }
+
+}
diff --git a/src/Robo/Inspector/Inspector.php b/src/Robo/Inspector/Inspector.php
index 542deee3d..9da3ced82 100644
--- a/src/Robo/Inspector/Inspector.php
+++ b/src/Robo/Inspector/Inspector.php
@@ -758,15 +758,6 @@ protected function warnIfDrupalVmNotRunning() {
     }
   }
 
-  /**
-   * Emits a warning if Drupal VM is initialized but user is not on VM CLI.
-   */
-  protected function warnIfNonInDrupalVm() {
-    if (!$this->isVmCli() && $this->isDrupalVmLocallyInitialized()) {
-      $this->logger->warning("Drupal VM is locally initialized, but you are not inside the VM. You should execute all BLT commands from within Drupal VM. Use <comment>vagrant ssh</comment> to enter the VM.");
-    }
-  }
-
   /**
    * Issues warnings to user if their local environment is mis-configured.
    *
@@ -785,7 +776,6 @@ public function issueEnvironmentWarnings($command_name) {
       ];
       if (!in_array($command_name, $exclude_commands)) {
         $this->warnIfDrupalVmNotRunning();
-        $this->warnIfNonInDrupalVm();
       }
 
       $this->warningsIssued = TRUE;