Cloud native workloads are more secure when they stay immutable, minimal, predictable, and limited to the behavior they were designed to have. By default, containers provide some level of isolation, but they do not fully enforce this opinionated model at runtime. A workload can still drift, execute unexpected code, or reach kernel functionality it should never need.

This poster presents Micromize, an open source project that uses eBPF LSM to preserve well-formed cloud native workload behavior after deployment. Micromize narrows runtime behavior and reduces unnecessary kernel exposure, helping close classes of attacks that depend on mutability, unexpected execution, or access to irrelevant kernel interfaces.

We will show the design, tradeoffs, and open questions behind enforcing stricter runtime semantics for workloads that are intentionally built to be immutable and predictable.