If you want to run a service in a container for security purposes and it doesn’t need to use the gpu, you can just use any container management software to run it.

Then your “whole pc” is the private part that only you have access to and the stuff in the container is the “public” part.

If the service needs to use the gpu then it might be worthwhile to run it in a vm with gpu passthrough.

No matter what though, you need to say what you’re trying to do. Like exactly what you’re trying to do. Like what specific software packages you’re trying to run and how you want the “anonymous” and “public” sections to be different.

It almost sounds like you wanna run a stable diffusion setup with two different model sets so an authenticated user can make pictures of Donald trumps head on Christina Hendricks body but public users can only do normal generic stuff.

Someone already said the firewall, and that’s the most straightforward answer, but there’s lots of stuff a server can be used for and most of those have some facility for making a distinction between unauthenticated users and authenticated ones. So as a second recommendation: use the permissions system.

What are you actually trying to do?

Have you considered using Quebes?

I might just be tired but I’m having a hard time understanding what you’re asking.

If I understand your question, you can just assign some of your server endpoints a public IP/URL and keep some others behind the firewall. My home lab exposes some services to the open internet, while others are only accessible with a VPN.

Okay, what do you want?

“Quebes” maybe means QubesOS, so you are searching for an operating system, but since you mentioned problems with GPUs, you probably have Nvidia cards and to that I can only say good luck getting Nvidia cards to run with docker.