I use a mixture of systemd-nspawn and different user logins. This is sufficient for experimentation, for actual use I try to package (makepkg) those tools to have them organized by my package manager.
Also LVM thinpools with snapshots are a great tool. You can mount a dedicated LV to each single user home to keep everything separated.
While being an environment issue, the plastic wrappings have a practical purpose: protect food from roaches. In many japanese cities you cannot have food open without attracting gokiburi within a few hours. This is also why the japanese keep everything as clean as possible. Even in the shadiest places there is someone with a vaccuum and a stickytape floor roller(!) to prevent the smallest crumb from staying on the floor too long. Eating on the move in the streets is frowned upon, because fallen down crumbs attract roaches. Public trashcans are rare, because - you guessed it - roaches. You are expected to carry any trash back home and put it in a sealed bag in your trashbin. The typical size of japanese houses and flats does not offer much space for storing large food containers, so you buy your food in small portions.
Of course a more environment-friendly wrapping would be better, but it has to be able to withstand a roach nibbling on it, which is not the case for various organic-based polymers.
After many years of using multiple devices and even servers with Archlinux installed it never broke because of an update (spoiler: I use systemd-boot instead of grub). If a system is to be used by a less experienced user, just install linux-lts Kernel instead.
Unstable does not mean it crashes/breaks often, it just means it does not guarantee to not bump to the newest upstream version and that it does not do backports. This can be a problem when using unmaintaned software that does not like using a recent python/php.
This is also great because if you find a bug in a software you can report it to upstream directly. Debian maintainers only backport severe bugs, not every one of them. It can take over a year for new features to arrive - especially painful with applications like gimp, krita, blender, etc. You can use debian-unstable of course, which is close to upstream as well.
Do not expect you can offer this service for a competive price against cloud prices. Caring for a company IT system is a big challenge and requires more work the more users there are.
For a company this size: make a clear contract. Consider how much time you need for setup/installation, monthly hours for maintenance, monitoring and at least daily(!) backups. Let them choose if they want it with a failover and charge for the required hours and material. Also put in the contract when they can expect support from you, including a clause for a holiday substitute admin (if needed). Then put a pricetag on support hours for holding people's hands when they "can't find that file they uploaded a week ago and it is surely a server issue" and put a pricetag on engineering hours for any modifications they might want, like installing any plugins they deem useful for themselves. Hardware prices, traffic, rack space and power should be included as well. Have a good plan for updates, choose your distro wisely, do not rely on autoupdates.
Play all this through in your head, add up the hours, choose a fair rate and then you have your pricetag.
Cloud will always be cheaper, because they have their infrastructure already deployed. Building from the ground up is more expensive, but I think it is worth it. Will they?
GoogleTalk once federated with XMPP/jabber, good times until their userbase was big enough to deferedate again, crippling the jabber network. It will happen again if we let it.
Metas plan is to draw users into their network and use the fediverse as an initial catalyst ("look! so much content already there!"). Once their userbase is large enough, they will deferate again claiming protocol difficulties or something equally vague, but they will just want to start rolling out advertising which would not be displayed to users from other instances. Most users will not keep two accounts and jusy stay with the big corp and leave the original fediverse again.
Well, NASA trusts Linux enough to send it to Mars. They build rockets, so it should be good enough for flying busses. Unless you don't trust your software engineers, but then having them build a custom microkernel OS instead sounds not much better.
Set it to airplane mode the day it arrives and never let it go online with the stock firmware if you value privacy - these beasts even send amazon the page you are reading currently on. Calibre is the best tool, it autoconverts anything if needed. It also has an RSS-to-newspaper feature that can create a custom newspaperlike magazine from your favorite feeds for you. Reading manga on Kindle is really fun.
Disappointing that 2/3 of the remaining users seem to vote for reopening.
if you enjoy this, there are various CTF "crackme" challenges available - the most famous one being the radare2 tutorial crackmes. The have different diffuculties from really easy to mind-bendingly difficult.
My vote is Archlinux. Debian is sometimes a little too "optimisitic" when backporting security fixes and upgrading from oldstable to stable always comes with manual intervention.
Release-based distros tend to be deployed and left to fend on their own for years - when it is finally time to upgrade it is often a large manual migration process depending on the deployed software. A rolling release does not have those issues, you just keep upgrading continuously.
Archlinux performs excellent as a lightweight server distro. Kernel updates do not affect VM hardware the same they do your laptop, so no issues with that. Same for drivers. It just, works.
Bonus: it is extremely easy to build and maintain your own packages, so administration of many instances with customized software is very convenient.
Don't know about that app, but it is very easy to create a file that contains malicious code that is not flagged on virustotal at all.
'joe sandbox' and 'hybrid analysis' offer online services where the file gets executed to test it for malicious behaviour. Of course a seasoned malware developer can detect sandboxes and make the malware hide itself while inside the default sandboxes.
Just avoid running random binaries from untrusted sources; prefer open source or, if you must, use a hardened sandbox VM yourself to run untrusted code.
In case you get stuck again and need more games:
Notable mentions: WorldOfGoo, Human Resource Machine