I’m running all services in seperate FreeBSD’s own old, mature and trusted “containerization” called jails. On this host, these jails are managed via BastilleBSD and make use of ZFS features.