I would try very hard not to get into a situation where the “security” of the underlying OS is relevant. An OS instance is going to run exactly one service. Tha

I would try very hard not to get into a situation where the “security” of the underlying OS is relevant. An OS instance is going to run exactly one service. That service’s code and configuration are the ball game. If the service is part of a larger distributed system, then network isolation (for the hosts it doesn’t need to reach), application level authn/authz (on the peer instances it does need to reach), and monitoring/alerting about the host’s behavior in its interactions with other hosts can all help to protect the larger system if the host is nevertheless compromised.