Not really an agency but we (ISP/MSP) host sites (on FreeBSD) for many of our customers. Some of them we also design/develop and some sites are "managed" by the

Not really an agency but we (ISP/MSP) host sites (on FreeBSD) for many of our customers. Some of them we also design/develop and some sites are "managed" by the customers themselves (mostly these are just WordPress sites). Sites that are 100% static content co-exist in a single jail but, other than that, it's one jail per customer (whether they have one or multiple sites). We would separate multiple sites belonging to the same customer into multiple jails if there was a good reason to, though. Another jail runs nginx as a reverse proxy in front of the jails. The big concern for me was the compromise of one site affecting other, unrelated customers. That's why we've separated them like this.