With some small systemd configs each native app is essentially a container these days. The overhead of unique kernels per app would really restrict what could fit on a small box like this
replyDynamicUser and ProtectSystem keep me sane.
Like the other person said, proxmox allows containers or full VMs, and the base OS takes less than 2 GB RAM.
replyMy jellyfin LXC idles at a few hundred megs of ram, shares the base debian kernel, and if anyone does ever break in, they don't get access to anything else, anywhere else on my server. (All media is also mounted read-only to the jellyfin LXC.)
I really, really like it, just set it up recently. Everything in its right place.
Much prefer LXC + IaC to rebuild them, but much of a sameness
reply