> Why "app"? These are services. Yes, but I was using my initial post's parent's terminology. But I agree, in my mind, the subject was one single "service", as

> Why "app"? These are services. Yes, but I was using my initial post's parent's terminology. But I agree, in my mind, the subject was one single "service", as in process (or a process hierarchy, like say with gunicorn for python deployments). > This is an argument for unikernels. It is. And I'm also very interested in the developments around Firecraker and similar technologies. If we'd be able to have the kind of isolation AWS promises between ec2 instances on a single physical machine, while at the same time being able to launch a process in an isolated container as easy as with docker right now, I'd consider that really great. And all the other "infrastructure" services you talk about could just live their lives in their dedicated containers. Not sure how all this would compare, performance-wise, with just enabling the mitigations.