Ipv6 only hosting still seems as good as an airgap😅

true enough, video acceleration is a bit harder / more expensive with an extra gpu, thats why i shyed away from suggesting vms

im not on arch but the explanation is still valuable: https://wiki.archlinux.org/title/Systemd-nspawn

There are systemd nspawn Containers, you could install debian, or whatever you fancy inside, they provode simmillar isolation to docker containers and you can even integrate them with gui.

Containerized apps will then only see the container folder

https://michael.franzl.name/blog/posts/2023-12-02-run-graphical-wayland-applications-in-systemd-nspawn