Usw VMs and isolate them according to separation of concerns. Same with mobile phones. Nix OS is also a good idea.