You can have physical partitioning on low end machines, too. The cpuset cgroup allows you to partition processes so that they only run on certain cores, and the

You can have physical partitioning on low end machines, too. The cpuset cgroup allows you to partition processes so that they only run on certain cores, and then you can prevent them from accessing memory through other cores, and and and... And you'll still find side channel attacks that you didn't think of, because the system is complex. Or you can buy a dozen cheap systems and run each of your customers on one of those. There's still the opportunity for side channels there - We were finding timing exploits in crypto libraries long before VMs. It's an arms race, and we're neither winning or losing, but as the market grows the spread gets wider.