Nobody shares your CPU cache

The pentest report has a section on cross-tenant side channels. Spectre, Meltdown, their cousins. The question for your signing service is: who else runs on this CPU?

On a hyperscaler the honest answer is: unknown strangers, on a shared hypervisor, on shared DIMMs. On a rented Hoody server the answer is: nobody. The physical machine is allocated to you alone. No other customer's workload touches the cache or the memory bus. KSM is off on every host, so memory pages never merge between tenants even on principle.

Your signing container still runs inside a hardened kernel with seccomp and its own namespaces. What it no longer has is a neighbour.

You write one line in the report. The side-channel question has a one-word answer when there are no neighbours.