All that is needed to prevent remote exploits from taking effect is strong input/output sanitization, and firewall. It becomes next to impossible to exploit vulnerable software if you are limited to the characters you can send.
Most web services do this in the network level with load balancers that forward only a single port to the service VM that is otherwise behind NAT to prevent any access to any other program in the VM that is left listening on a port. You can extend this concept to the input and output processing of the service.
Most web services do this in the network level with load balancers that forward only a single port to the service VM that is otherwise behind NAT to prevent any access to any other program in the VM that is left listening on a port. You can extend this concept to the input and output processing of the service.