gVisor
ActiveDescription
Google's user-space kernel sandbox that intercepts container syscalls.
Key Features
- User-space kernel — runsc intercepts syscalls
- Strong isolation — Container decoupled from host kernel
- Kubernetes integration — runsc as a runtime
- Low overhead — Lighter than VMs
- Multi-platform — Go runtime portable
Use Cases
💡 Kernel-level isolation in multi-tenant containers.
💡 Secure sandbox for untrusted workloads.
💡 Strong-isolation containers on GKE/Cloud Run.
Categories
Quick Start
# Install and run
docker run --runtime=runsc -it alpine
# Verify the service is up