gVisor
gVisor is an application kernel written in Go that provides a strong isolation layer between applications and the host OS, implementing a Linux-like interface. It solves the problem of containers not being secure sandboxes by limiting the host kernel surface accessible to applications. It is for developers who need to run untrusted or potentially malicious code in containers with stronger isolation.
✨ Key features
- Application kernel written in memory-safe Go, runs in userspace
- Provides OCI runtime 'runsc' for Docker and Kubernetes integration
- Limits host kernel surface while maintaining application compatibility
- Lower resource footprint and fast startup compared to VMs
- Supports x86_64 and ARM64 architectures
- Includes containerd shim for integration with containerd
🎯 Use cases
- Run untrusted containers in Docker with sandboxing
- Secure multi-tenant Kubernetes workloads
- Isolate potentially malicious code in containers
- Develop and test gVisor itself or its subpackages
- Use Netstack userspace networking in Go projects
📦 Installation
🧰 Requirements: Linux 5.6+ and Docker version 17.09.0 or greater for building from source.
make release-tarball DESTINATION=bin/
sudo tar -C /usr/local/bin -xf bin/gvisor.tar.bz2
To build specific libraries or binaries:
make build TARGETS="//pkg/tcpip:tcpip"
For direct Bazel builds:
bazel build -c opt //debian:gvisor-release-tar-bz2
🚀 Usage
# After installing runsc, configure Docker to use it as runtime.
# Example: docker run --runtime=runsc hello-world
⚠️ Good to know
gVisor is not a syscall filter or a VM; it is an application kernel that runs in userspace, and the 'go' branch is not supported for building runsc.
❓ FAQ
What is gVisor?
gVisor is an application kernel written in Go that provides a strong isolation layer between applications and the host OS, implementing a Linux-like interface.
How does gVisor differ from seccomp or VMs?
gVisor is not a syscall filter nor a VM; it takes a third approach by running an application kernel in userspace, providing many security benefits of VMs with lower overhead.
What architectures are supported?
gVisor builds on x86_64 and ARM64; other architectures may become available in the future.
Can I use gVisor with Docker?
Yes, gVisor includes an OCI runtime called runsc that integrates with Docker and Kubernetes.
📊 Repository
🤖 Overview, features, install steps and FAQ were generated from the project's README on Sep 4, 2026. Always check the original source before running commands.