However, I strongly advise you to read up on how production environments are done in security conscious enterprises (banks, payment providers, etc) as you seem to make some assumptions in your comment. To give you some idea of the environments I've designed in the past:
A WAF worth it's name won't pass any request back to a webserver if it matches a known signature, method, payload, etc. This is a functionality commonly called virtual patching. SSH is usually only allowed on internal vlans and often requires some sort of external authentication mechanism like a centralised jumpserver or ldap.
Also, if using Solaris with OVM for SPARC you wouldn't boot up a new server but a non-global zone (think Docker but 2 years from now) which can be started in ~1 second and offer full isolation from the host system. AIX also does something similar and I've seen several different approaches used on Linux from LXC to VMware + F5 irule based auto-scaling groups.