Use a host operating system designed for running containers so that the attack surface outside the container runtime is minimal. Remove unused services and apply immutable patterns where supported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.