A group which I'm part of has grown and is about to move from using DigitalOcean VPSes to a single colocated server. At this point, we don't have a need to distribute our service very highly. This monolithic server will be running pretty much all of our systems, from our public-facing website to our mail service to custom daemons and control panels.
There has been concern, however, about the possibility of one service becoming compromised (we have been a target of intrusions in the past) and causing stability or a security breech in other parts of the server.
What we're looking to do is somehow "sandbox" certain services and processes, restricting the amount of resources (RAM, CPU) they're able to use. It's been suggested running each "set" of services on a different VM, but that seems clunky and difficult to maintain to me. I would think that Linux would have a more elegant way of handling this. Does anyone have any suggestions on the best way to accomplish this?
We're using CentOS 6.4 64 bit.