Application code is obtained at a compiler toolchain, which accesses a package manager that tracks dependencies for a set of software components including application-level components represented as application-level packages, hypervisor interface-level components represented as hypervisor interface-level packages, and hypervisor-level components represented as hypervisor-level packages. A dependency solver is employed to select a sub-set of the set of packages that satisfy the dependencies. The sub-set of packages is assembled into an executable bundle, including a statically-linked binary built entirely from the sub-set of the selected packages that contains no external dependencies except calls to an interface defined entirely by the hypervisor interface-level packages, and a specialized monitor built entirely from the sub-set of the selected packages that runs on a standard operating system, loads and executes the statically-linked binary, and interacts with the statically-linked binary only through the interface defined by the hypervisor interface-level packages.