Compile the node to a unikernel
To enhance the security of validating nodes running on the network, we can minimize their attack surface by compiling them into a unikernel (using MirageOS for instance). We should have the scripts in place to do this build and test that it works.
@vbmithr's comment: Not that simple, compiling Tezos to MirageOS is far from being a turnkey process. Plus there might be limitations in MirageOS that will make porting complicated.