Neither. Both have fundamental issues toward confident updates and validation of software, speaking as someone who used to run the security response for an Enterprise OS vendor.

I’m looking at CloudStack now, and it’s got some promise despite one odd glitch. I may try to stick with it .