How to set up a web server with service isolation?

Question

Nginx

Good day!
Until recently the webserver was configured like this: nginx on the host and php-fpm on the Openvz containers.
In the nginx config, in location, I specified the path to the directory with the web in the container, and everything worked.
Now, for some reason, I decided to move everything to KVM. Do I understand correctly that in order to maintain an approximate isolation of services, it will be necessary to raise nginx + php-fpm on each virtual machine and raise the nginx proxy reverse on the host?

Answer 1

Yes.
You can DNAT from the host 80/443 port in the VM.
Check out LXC/LXD if you have experience with containers.