I&#x27;m not sure how this is different from containers security. Provided you strip it down properly and not &quot;my container is whole system + my binary&quot;, how is the exposure different exactly?<p>Both will prevent persistence, both are restricted outside, not internally. If anything I&#x27;d say that reduced number of devices give you lower attack surface over hypercalls (unikernels) than having direct access to all the syscalls (container).<p>What&#x27;s the huge difference and where&#x27;s the theater?