I do it like this, but on one computer, using QEMU. I have 3 different VMs for

- development & AI tools

- infra rollouts

- banking / other sensitive services

I have Steam Deck for gaming, and do most of casual web browsing still on host, because it's secure enough to use Firefox with ublock + privacy badger and enforcing SELinux. However, I dont use socials other than HN and Reddit under pseudonymous accounts. If I had real zuckerbook or instacrap accounts, maybe I'd have another VM for socials too.

▲

codedokode 4 hours ago | parent [-]

Why do you people love over-engineering and bad architectures so much? Do you have any sense of engineering beauty? Modern CPUs already run every application in an isolated sandbox under "protected mode". There is no need to emulate a machine with hardware devices, run a separate kernel, drivers and services. The only problem is that the OS kernel and privileged system services usually grant too much ways to bypass the sandbox. So the proper architecture would be to re-design and fix the existing OS instead of using ugly hacks like VM.

I also use VM to run code editors and AI. One must be crazy to run third-party software (including package managers like npm) unrestricted. The overhead is significant, and VS Code UI is lagging heavily without a GPU.

	▲	Retr0id 4 hours ago \| parent \| next [-]
		This was reasonable advice 12 months ago, but at the rate kernel exploitation is going it's less of a security boundary than ever. Hypervisors aren't much better, but it helps.
	▲	darkwi11ow 4 hours ago \| parent \| prev [-]
		CPU and memory are not the only concerns, file system and network access are dangerous as well, and they tend to be less instrumented in terms of hardware isolation.