we lock down the nodes themselves so that only the hypervisor has direct access. we take this pretty seriously.