The rules now are generally: bare metal if that’s all the box will do, or it’s main task, container if it’s one of many services, vm if it’s a larger application you might migrate and i/o isn’t your limitation.
The line between container and vm is fuzzy, but bare metal means you’re making a design choice for that machine and if that or another application breaks the machine you’re screwed.
In a way freebsd is amazing for this, you put all applications in jails and don’t use the main userspace much, but the virtualiztion story isn’t quite there yet.