Ideally none, with scratch containers for applications and the bare minimum running under your orchestrator which becomes your main interface.