I run everything in LXC containers because AFAIK using VMs mean you are limited on shared resources. If I want to use the iGPU for Plex and something else it would be locked to only work on the Plex VM. I mainly just have an unprivileged LXC and a second privileged LXC both running portainer that run most of my services.