Ask and ye shall receive: https://news.ycombinator.com/item?id=35389882 https://news.ycombinator.com/item?id=35389882 We run Bottlerocket (previously Flatcar,

Ask and ye shall receive: https://news.ycombinator.com/item?id=35389882 https://news.ycombinator.com/item?id=35389882 We run Bottlerocket (previously Flatcar, nee CoreOS) which itself is running SSM for "break glass," so: only about 3 directories (and children) can physically be written to, no package manager, no sshd, and in Bottlerocket's case even getting to a shell on the host is so complicated I have it pinned in our slack channel. I haven't tolerated "general purpose" OSes for production machines in over 8 years because jokers just love to "just this one thing to troubleshoot..." exactly like the story above said