Comment by lrvick

IMO a secure server is an immutable appliance. I still build Linux from scratch most weeks as a core part of my job.

Bare bones hardened kernel + shim init + target application are all you need, and will be your highest security/reliability systems.

And yeah, threadrippers are a must.