SELinux is one of the first things I disable. It causes way more problems than it solves.

All my workloads are containerised so I’ll trust the security of that machinery to sandbox them instead