Anyone here familiar with MirageOS ? http://www.openmirage.org/ Supposedly, this system compiles a complete web site into software that boots & runs on bare metal, complete with whatever microkernel is needed just for this software. The idea is to remove _everything_ that isn't absolutely necessary to run, and thereby reduce the attack surface.