> This would be the only privileged code in my operating system

What does that mean? Are you building a system without a root user or something?

Correct. It does the bare minimum system calls to boot the system, then exec to an unprivileged service manager on a read only nosuid, nodev filesystem.

I design confidential compute systems.