gVisor
More info
- Creator
- Released
- Owner
- Type
- User-space kernel / sandbox
- License
- Apache 2.0
- Website
- gvisor.dev
- Source
- github.com/google/gvisor
- Wikipedia
- en.wikipedia.org
Google's user-space kernel — intercepts syscalls from the container and reimplements them in a sandboxed Go process instead of letting the host Linux kernel see them.
Two modes: ptrace (slow, works anywhere) and KVM (faster, requires virtualisation). Implements a subset of the Linux API — some workloads that poke at unusual syscalls or perf counters don't work.
Powers Google Cloud Run, App Engine Standard and Kaggle notebooks. Solid defence-in-depth against kernel exploits — even if an attacker RCEs your container, they only see gVisor's small syscall surface. Trade-off: 10–30 % overhead on I/O-heavy workloads.