Except this is because containers, as they arw commonly referred to, are an image of software compiled for linux + linux kernel specific technologies for running them (cgroups, namespaces) etc.

Nothing stops a microkernel from having gitten popular and then having got it’s own implemented containers. Linux won because it was first, not because monolithic is better.

What is the most popular unix like microkernel?

Macos is monolithic. Technically it’s “hybrid” but from a security architecture perspective hybrid suffers from all the same flaws of monolithic.

Linux containers are a security nightmare. The linux kernel has so much attack surface they add that constantly causes privesc cves, and it’s especially annoyimg when they break out of the container to the host. Literally 3 of the recent 0days wouldn t work if you disabled user namespaces, which are needed for rootless containers.

So nowadays, every cloud provider runs “containers” that are actually vm’s, in order to receive the same security that a microkernel would provide.

I don’t have/use TPM, but I do have encrypted swap and hibernation on a fully encrypted drive.

The trick is to put the kernels in the root partition, which is encrypted by LUKS. Then, you can also put a swapfile in that same partition.

The only unencrypted part of my system is /boot/etfi, which is the EFI partition that holds nothing but the grub binary. Grub configs and kernels are in /boot, which is on the root partition, and encrypted in LUKS.

Grub automatically scans hard drives, before prompting with a password to decrypt the root and everything on it. Because grub is doing the decryption, rather than the kernels, the kernels and swapfile are decrypted all at once.