Regardless of the OS, kernel, or program you select there will inevitably be holes in your stack. A VM will always provide better isolation and more flexibility. In this instance it would mean being able to patch the box running the service without messing with the driver for the backing storage.
Depends on the VM system. Full blown virtualization add complexity and attack surface. Running vmless[0] could be even better if you trust the design of the isolation enough.