&gt; &gt;Could something like Xen be more secure than the Linux kernel? Maybe. That&#x27;s a good question, and one I haven&#x27;t seen the answer to.<p>&gt; It ought to be, because the attack surface is zillions of times smaller (x86 spec vs all the system calls offered by linux).<p>Bullshit. Either your Hypervisor is a user mode program (it uses syscalls) and therefore requires a full kernel underneath all of the other abstractions you&#x27;ve got (which makes it slower). Or it&#x27;s like KVM, where it&#x27;s kernel mode and thus doesn&#x27;t need syscalls to break the host (does the phrase &quot;floppy driver local root&quot; mean anything to you?).