I've been using Canonical's LXD for this, under Debian Trixie. Nowadays I can usually get away with just running containers for things I need vs full-blown VMs. I guess the only downside is that in order to get the latest version of LXD installed easily you'd have to do it via snap, which I understand is a dealbreaker for many.
There's also been advancements in cylinder head technology (i.e., VTEC, VVT, etc), which I guess also falls under control systems, but worth mentioning as these technologies are very cool. Honda's iVTEC has it down to a damn science with how to optimize valve lift & duration across the entire RPM spectrum.
Right, there's definitely not a bunch of pressure from the fact that they can throw you in jail for basically anything and probably get away with shooting you if they really wanted that would get in the way of a real meaningful relationship...
When you setup your single ethernet port (let's call it eth0) as a VLAN trunk port, you'll get the ability to configure multiple virtual interfaces off of it. How many virtual interfaces you get depends on how many VLANs you want to tag traffic for. For example, if you have 2 VLANS with ids 100 and 200 (100 being your public Internet-facing traffic, and 200 being your LAN traffic), you would then have interfaces eth0.100 and eth0.200 to work with that you can then use in your firewall scripts as if they were two separate, physical interfaces.
This of course means you need a VLAN-aware switch that this single ethernet port can plug into, configured as a VLAN trunk (in Cisco terms) port. You would then want to configure one of the other switch ports as a VLAN access port assigned to VLAN 100 (untagged). This is the port you would plug your cable modem into. Then (in the simplest example) you could assign all the rest of the switch ports to VLAN 200 (untagged), and you would plug all your LAN devices into them.
Yes. You can take advantage of Netfilter's flowtable infrastructure and if you have the right hardware (NVIDIA/Mellanox ConnectX-5 or MediaTekMT7621) it will actually offload the processing of these packets to the NIC hardware. This only applies to established connections, however, but that typically accounts for like 95% of the traffic passing through.