[abeld]

A reasonable requirement which leads to "run everything in VMs" is the need to support on-premise deployments. Often data-security and compliance requirements can be handled most reasonably (or at all) by allowing the enterprise client to pick where to deploy a single-tenant copy of the service. For this, I think the most reasonable approach is to only require VMs and do all the configuration yourself (preferably in some scripted / automated manner).

Of course, in this case, (unless you install a private cloud), you forgo all the convenience and advantages of a cloud infrastructure (so one can argue that this wouldn't really count as 'cloud agnostic'), but since such on-premise deployments should only be required by big enterprise clients, they should have deep enough pockets to pay for it.