A cloud provider is designing a new multi-tenant IaaS platform and must select a virtualization approach for its compute hosts. The security architect insists that the virtualization layer expose the smallest possible attack surface and not depend on a general-purpose host operating system that could be exploited to compromise all tenant VMs. Which choice best satisfies this requirement?