[bayindirh]

The way I deploy them doesn't mean "compromise one, compromise all". For example, I generally leave SELinux intact. So they're properly isolated.