Yeah, a hardened kernel is great and I&#x27;m glad to see distros building kernels just for security-sensitive server applications.<p>However, setting kernel.modprobe to &#x2F;bin&#x2F;false is extremely high-impact in reduction of attack surface compared to how much effort it is (one line in &#x2F;etc&#x2F;sysctl.d&#x2F;); you can keep running a full-featured distribution kernel, even one from Fedora or Ubuntu that&#x27;s simultaneously intended for desktop use.