Wow, I try to use as few OS'es as possible, because it really isn't necessary to run everything in a different OS. Windows, Linux, OSX, pretty much everything has a native FTP server (OSX can host FTP without any external programs!) and there are plenty of HTTP servers out there. I also have mainly older hardware, single core processor machines (an AthlonXP and a Sempron) that I run servers on, these older machines aren't great for VM's but native apps run great. The only reason I would use a VM is as a testing environment with an OS that I'd never use otherwise, but I see no reason to test OS'es that I wouldn't use (not developing anything right now). For something as simple as an FTP though, I wouldn't recommend a VM. I also don't see how a native FTP would be that big of a security issue, worst that can happen is someone accesses your files that you've set for your account or deletes them, so if you backup you won't have a problem.