Another solution is to not compile drivers that you don&#x27;t need, and to take minimizing kernel attack space as seriously as running a firewall. It should, in my opinion, be routine to run a reduced kernel in production, however most of the industry appears to use stock kernels from a few major vendors. The likes of CoreOS are probably helping here. Keep it up.