undu

I know, yes. But I’m talking about virtualization, not containerizarion

Personally, I want to properly isolate the services with virtualization. The main reason is I expose some of the services online, and I don’t t want to only rely on keeping all software up-to-date at all times. This allows me to limit the damage if one of the services is compromised.

I wouldn’t use MacOS as the virtualization platform, and instead use something else, like BSD, Linux, or xen-based for my servers

Xcp-ng might have the edge against bare metal because Windows uses virtualization by default uses Virtualization-Based Security (VBS). Under xcp-ng it can’t use that since nested virtualization can’t be enabled.

Disclaimer: I’m a maintainer of the control plane used by xcp-ng