Best practice for multi-user zero-trust isolation on the same host

Support General Questions
1

Hi everyone,

I’m evaluating OpenZiti / NetBird for a scenario where multiple users share the same Linux host.

Example:

User A and User B log in to the same machine.  
User A should only access A’s resources.  
User B should only access B’s resources.  
They must not access each other’s services, identities, routes, DNS, or tunnels.

Questions:

  1. What is the recommended architecture for this scenario?
  2. Should each user run a dedicated tunnel/agent with a separate identity?
  3. How should routing, DNS, and TUN interfaces be isolated on the same host?
  4. Are Linux network namespaces, containers, or separate VMs recommended?
  5. Are there official best practices for this type of multi-user isolation?