The patient-records container fits on one page

The clinic's compliance officer asks where the patient records are, who can reach them, and how long history is kept. IT answers with one container.

The server is dedicated bare metal in Frankfurt; the disk is in that rack. The records sit behind a crypt backend on hoody-files, so the bytes on disk stay ciphertext even to a process on the running host. Firewall egress is deny-all. Proxy permissions allow the clinic's IP range and default: deny. The container lives in a healthcare-prod realm, so no other token in the account can enumerate it. A nightly cron POSTs a snapshot with expiry: 90: ninety days of history, and day ninety-one deletes itself.

Every item above is a setting readable at a URL. A shared cloud VM can't make the same statement; the hypervisor belongs to someone else.

The compliance posture is a list of settings on one container, in one building.