zoom_in Click to enlarge

gVisor

▲ ▼

language

description gVisor Overview

gVisor offers a secure container runtime solution developed by Google. It achieves enhanced isolation through kernel virtualization, effectively mimicking a separate operating system for each container. This approach significantly reduces the attack surface compared to standard containerization methods. gVisor is particularly valuable for organizations prioritizing security and needing robust containment of applications, especially in environments with sensitive data or complex network architectures.

It’s beneficial for developers and operations teams managing critical systems where application isolation is paramount.

help gVisor FAQ

What does gVisor's runsc runtime actually do?

gVisor includes runsc, an OCI-compatible runtime that can plug into Docker and Kubernetes workflows. Instead of letting the container talk directly to the host Linux kernel, gVisor routes many system calls through its own userspace application kernel.

Is gVisor a virtual machine like Firecracker or QEMU?

No. gVisor is not a full hardware VM, and its own documentation describes it as a third approach between native containers and machine virtualization. The Sentry component is written in Go and acts like a Linux-like kernel in userspace.

Why would a Kubernetes team use gVisor?

A team may use gVisor to add a stronger isolation layer for multi-tenant or untrusted workloads. Google Cloud has offered it through GKE Sandbox, and the core project also documents Kubernetes use with runsc.

What is the tradeoff when using gVisor instead of runc?

The tradeoff is compatibility and system-call overhead. gVisor does not implement every Linux system call or proc/sys file, so some workloads that run under runc may need testing before production use.

swap_horiz

Looking for gVisor alternatives? Compare top competitors ranked & scored

arrow_forward