You can use seccomp to reduce the scope of the Linux system call API.<p>I think the real point here is that AWS exists, and so virtualization is the new baremetal, but the advantage over baremetal is the range of &quot;hardware&quot; is much more limited.  You have virtio &#x2F; XenPV disks, not twenty different SCSI devices you need to write drivers for and debug.  Therefore writing interesting kernels directly to the virt layer and running those in the cloud makes sense.