If this is the kind of protection you want you should be running everything in seperate VMs and containers. Preferably you would run the hypervisor (perhaps a h

If this is the kind of protection you want you should be running everything in seperate VMs and containers. Preferably you would run the hypervisor (perhaps a hardened bare-metal hypervisor) on your server and remotely connect to the instances with your client. The client is solely used for connecting to those instances. The hypervisor itself will need to be well protected and you do not want that accessible from your client or the VMs and containers - use a seperate NIC or VLAN. This is the reason why you want a seperate server - the only things the client will see are the shared containers. Let's assume here that VMs and containers are secure - if they aren't, you can replicate this with seperate physical machines. On the server you can set firewall rules to control access between the different containers. Network storage etc. can also be setup for the containers that need it, with different permissions depending on the situation. Depending on the stuff you are running, you may want to go the VDI or SSH route. Also there are other options like XPRA, etc. depending on your requirements. The more segmentation you do (i.e. one VM for the dev envionment for a specific app, another for chat and email, etc.), your security will increase at the cost of usability. I personally do this in a limited fashion (I have secure workstations and VDIs for handling of private/financial information), but do not go the full route of seperating everything out for day-to-day computing.