Whonix

Whonix's core design trick is splitting itself into two virtual machines that only talk to each other over an isolated internal network: the Gateway VM handles nothing but Tor routing, while the Workstation VM (where you actually browse and work) has no direct route to the internet at all except through that Gateway. Even if malware or a browser exploit fully compromises the Workstation, it structurally cannot leak your real IP address, because the Workstation never had a way to reach the internet directly in the first place -- a stronger guarantee than a single-VM Tor setup can offer. It's normally run inside VirtualBox or KVM on top of a regular host OS (including Qubes OS, where 'sys-whonix' is a built-in integration), rather than booted directly on hardware.