"as much as possible" would be to put it in a virtual machine, or actually separate physical hardware, maybe in a multi-million-dollar bank vault to prevent phy

"as much as possible" would be to put it in a virtual machine, or actually separate physical hardware, maybe in a multi-million-dollar bank vault to prevent physical tampering. Then there's a reasonable amount of isolation, which would be to run it under its own user, which can only write to one or two directories, and can't read user directories or non-world-readable system config files. This is already common practice. (Creating this user at package install time, or in the initial base distro config, is completely sufficient. And simpler.) "as much as possible" is really not worth it (and sucks resources away from implementing reasonable security practices elsewhere).