I recently setup Nextloud 12
https://nextcloud.com/ inside a FreeBSD jail. My Nextcloud instance is externally accessible, and yet if someone were to get inside my Jail, I could rest easy knowing they still didn’t have access to the rest of my host server. I chronicled the setup process including jail setup using iocage
https://github.com/iocage/iocage, https with Lets Encrypt
https://letsencrypt.org/, and full setup of the web stack.