Fedora 44 server with enforcing SELinux and one gVisor sandbox per container. Bare metal: KVM and strict IPE. VM: systrap and an explicitly weaker IPE userspace-execution policy. Development builds; release validation pending.