Technical reason is to limit blast radius, easier permission management, easier scaling. For blast radius, you have things like patching (you don't want to bot

Technical reason is to limit blast radius, easier permission management, easier scaling. For blast radius, you have things like patching (you don't want to botch the database accidentally updating a shared dependency with your app), resource management (don't want your DB to eat all the RAM or I/O and kill your app), if someone botches maintenance there's less to break at once You don't have to use VMs but they're one way to do it. Container orchestrators achieve many of the same goals and automatically restart workloads if a physical machine fails, too