I fear this may be a somewhat open-ended question that gets closed: Apologies in advance, but I'll give it a shot!
I'm considering operating an OpenBSD VM with a number of services running on the same instance (SSH, IMAP, SMTP, some HTTP server and VPN). Should I sandbox these daemons, some how (e.g., chroot jails), to ensure they don't interfere with each other, or is the OpenBSD/POSIX model already sufficient? Is there anything else I should be aware of?
Most of OpenBSD’s internal daemons are already privilege separated and chrooted.