Anything that needs a kernel module (OpenVPN with tap for example) is better off as a separate VM. Or anything that is not linux, so BSD, Illumos etc.

Also I am using Nomad over baremetal to create VM's with Nomad clients onboard. Kind of a messy setup, but works really well for me.