> But do you need to boot a custom image? You still need to boot from something custom or otherwise, and that something needs to be updated and maintained. Rea

> But do you need to boot a custom image? You still need to boot from something custom or otherwise, and that something needs to be updated and maintained. Realistically it's probably going to be slightly more on the custom side once you take into account drivers for special snowflake stuff like fancy NIC's and storage controllers. The OS itself is largely irrelevant, but managing the consistency its state (or lack thereof) and configuration across a fleet is quite important IMO. When you're talking bare metal you have a lot of other security holes you need to deal with as well; BMC's, firmware, drivers etc all need to be kept up to date (and tested).